Threats affecting pkg:github/axiom-crypto/snark-verifier

CVE-2026-61618 is an improper input validation vulnerability in axiom-crypto's snark-verifier prior to version 0.2.5. The issue arises because KZG accumulator public-instance limbs are decoded without enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. This can lead to noncanonical encodings reaching the verifier boundary and potentially causing a crash in the native verifier. The vulnerability is fixed in version 0.2.5.