{"id":"GHSA-vjf8-9fx6-mv6x","aliases":[],"url":"https://o3.security/vulnerability/GHSA-vjf8-9fx6-mv6x","summary":"Triton VM Soundness Vulnerability due to Missing Constraint","details":"The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents.\n\nAny application using instruction `sponge_absorb_mem` to hash memory data can be given a proof for a forged hash that doesn't correspond to the actual memory. This breaks the security of memory-based commitments.\n\nThe flaw was corrected in commits `17c7ba0a` and `ef9d9e72` by including the appropriate constraints.","published":"2026-08-18T20:22:21Z","modified":"2026-08-18T20:30:07.247240899Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"triton-vm","fixedVersion":"4.0.0"}],"fix":{"url":"https://github.com/TritonVM/triton-vm/commit/17c7ba0a19f31793f1c807a58afaf9504342aac5","label":"TritonVM/triton-vm@17c7ba0"},"references":[{"type":"WEB","url":"https://github.com/TritonVM/triton-vm/commit/17c7ba0a19f31793f1c807a58afaf9504342aac5"},{"type":"PACKAGE","url":"https://github.com/TritonVM/triton-vm"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2021-0156.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T20:30:07.247240899Z"}}