{"id":"GHSA-vjf8-9fx6-mv6x","title":"Triton VM Soundness Vulnerability due to Missing Constraint","summary":"Triton VM Soundness Vulnerability due to Missing Constraint","severity":"medium","cwe":["CWE-345"],"vendor":"triton-vm","product":"triton-vm","ecosystem":"rust","affected":["triton-vm >= 0.42.0-alpha.4, < 4.0.0"],"patched":["triton-vm 4.0.0"],"published":"2026-08-18","updated":"2026-08-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-vjf8-9fx6-mv6x","references":[{"url":"https://github.com/TritonVM/triton-vm/commit/17c7ba0a19f31793f1c807a58afaf9504342aac5"},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0156.html"},{"url":"https://github.com/advisories/GHSA-vjf8-9fx6-mv6x"}],"tags":["ghsa","rust"],"ingestedAt":"2026-08-18T21:23:00.254Z","slug":"GHSA-vjf8-9fx6-mv6x","body":"## Overview\n\nThe instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents.\n\nAny application using instruction `sponge_absorb_mem` to hash memory data can be given a proof for a forged hash that doesn't correspond to the actual memory. This breaks the security of memory-based commitments.\n\nThe flaw was corrected in commits `17c7ba0a` and `ef9d9e72` by including the appropriate constraints.\n\n## Affected packages\n\n- `triton-vm >= 0.42.0-alpha.4, < 4.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `triton-vm 4.0.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}