High severityGHSA Advisory· Published Jun 10, 2026· Updated Jun 11, 2026

CVE-2026-46654

Description

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
p3-challengercrates.io	< 0.4.3	0.4.3
p3-challengercrates.io	>= 0.5.0, < 0.5.3	0.5.3

Affected products

Plonky3/Plonky3GHSA
Range: >= 0.5.0, < 0.5.3
ghsa-coords
pkg:cargo/p3-challenger
Range: < 0.4.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vj64-rjf3-w3v7ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-46654ghsaADVISORY
github.com/Plonky3/Plonky3/security/advisories/GHSA-vj64-rjf3-w3v7nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000