CVE-2026-40323: SP1 V6 Recursion Circuit Row-Count Binding Gap

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-18 · updated 2026-10-26
Weakness: CWE-345

Description

SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.

Affected products

succinctlabs sp1: from 6.0.0 before 6.1.0 — fixed in 6.1.0

How to fix

Upgrade to a fixed version: succinctlabs sp1 6.1.0. Check the vendor advisory for mitigations.

References

https://github.com/succinctlabs/sp1/releases/tag/v6.1.0
https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33

Get alerted when CVE-2026-40323 or the next vulnerability affects your stack