---
id: RUSTSEC-2021-0156
aliases:
  - GHSA-vjf8-9fx6-mv6x
title: Triton VM Soundness Vulnerability due to Missing Constraint
summary: Triton VM Soundness Vulnerability due to Missing Constraint
severity: none
vendor: triton-vm
product: triton-vm
ecosystem: rust
affected:
  - 'triton-vm >= 0.42.0-alpha.4, < 4.0.0'
patched:
  - triton-vm 4.0.0
published: '2021-06-11'
updated: '2026-08-24'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2021-0156'
references:
  - url: 'https://crates.io/crates/triton-vm'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2021-0156.html'
tags:
  - osv
  - rust
ingestedAt: '2026-08-24T19:25:44.898Z'
---

## Overview

The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents.

Any application using instruction `sponge_absorb_mem` to hash memory data can be given a proof for a forged hash that doesn't correspond to the actual memory. This breaks the security of memory-based commitments.

The flaw was corrected in commits `17c7ba0a` and `ef9d9e72` by including the appropriate constraints.

## Affected packages

- `triton-vm >= 0.42.0-alpha.4, < 4.0.0`

## Remediation

Upgrade to a patched release:

- `triton-vm 4.0.0`