Description
SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for the RISC-V architecture. In versions 6.0.0 through 6.0.2, a soundness vulnerability in the SP1 V6 recursive shard verifier allows a malicious prover to construct a recursive proof from a shard proof that the native verifier would reject. Version 6.1.0 fixes the issue.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/succinctlabs/sp1/security/advisories/GHSA-63x8-x938-vx33
X_Refsource_Misc x_refsource_misc
https://github.com/succinctlabs/sp1/releases/tag/v6.1.0
Scores
CVSS v3
7.5
EPSS
0.0019
EPSS Percentile
9.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-345
CWE-354
Status
published
Products (5)
crates.io/sp1_prover
6.0.0 - 6.1.0crates.io
crates.io/sp1_recursion_circuit
6.0.0 - 6.1.0crates.io
crates.io/sp1_sdk
6.0.0 - 6.1.0crates.io
succinct/sp1
6.0.0 - 6.1.0
succinctlabs/sp1
>= 6.0.0, < 6.1.0
Published
Apr 18, 2026
Tracked Since
Apr 18, 2026