{"id":"EUVD-2026-24062","enisaUuid":"ad021538-632e-38f8-b7e9-e4f602cd9289","description":"SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.","datePublished":"Apr 17, 2026, 10:58:42 PM","dateUpdated":"Apr 20, 2026, 4:16:41 PM","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33\nhttps://github.com/succinctlabs/sp1/releases/tag/v6.1.0\n","aliases":"CVE-2026-40323\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"f7219436-7e4a-33a7-a871-176a531bdf8a","product":{"name":"SP1","vendor":{"name":"succinctlabs"}},"product_version":"6.0.0, \u003c 6.1.0"}],"enisaIdVendor":[{"id":"83cd9e0d-481c-39b0-b3f1-a5d7703073e2","vendor":{"name":"succinctlabs"}}],"enisaIdVulnerability":[{"id":"1c9b5db7-1770-3f0a-a7f3-100f60270dab","vulnerability":{"id":"CVE-2026-40323","description":"SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.","datePublished":"Apr 17, 2026, 10:58:42 PM","dateUpdated":"Apr 20, 2026, 4:16:41 PM","status":"PUBLISHED","baseScore":8.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33\nhttps://github.com/succinctlabs/sp1/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-24062\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"f6686440-9724-31b0-ad1c-9dfbb858d285","product":{"name":"SP1","vendor":{"name":"succinctlabs"}},"product_version":"6.0.0, \u003c 6.1.0"}],"vulnerabilityVendor":[{"id":"d2b332ab-8891-3bea-9058-e3a53ab24c34","vendor":{"name":"succinctlabs"}}]}},{"id":"40ef04cd-26bb-3a49-b323-3a90fa4deb19","vulnerability":{"id":"GHSA-63x8-x938-vx33","description":"SP1 V6 Recursion Circuit Row-Count Binding Gap","datePublished":"Apr 14, 2026, 12:05:19 AM","dateUpdated":"Apr 24, 2026, 8:50:48 PM","baseScore":0.0,"references":"https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40323\nhttps://github.com/succinctlabs/sp1\nhttps://github.com/succinctlabs/sp1/releases/tag/v6.1.0\n","enisa_id":"EUVD-2026-24062\n","aliases":"CVE-2026-40323\nGHSA-63x8-x938-vx33\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}