[D33BaT0]

Affected crate(s)

• ark-groth16 (1,274,253 recent downloads; 7,115,682 total; 0.6.0 itself: 164,388. crates.io, 2026-10-20)

Links to upstream issue(s) or PR(s)

• ark-groth16: Groth16::prepare_inputs omits public_inputs length check, silently truncating extra inputs and zero-padding missing inputs arkworks-rs/groth16#101 (report, no maintainer response yet)
• Add length check in prepare_inputs for Groth16 verifier arkworks-rs/groth16#86 (same check, open since 2025-09-04; maintainer has not accepted it because it changes behavior on mismatched lengths)

This issue is the request to turn that report into an advisory:
#3404

Severity

The native verifier accepts a public-input slice of the wrong length instead of returning an error. Extra elements are ignored, so they are not bound by the proof. Missing elements are treated as zero. A caller that treats a successful verification as covering the whole slice can therefore
accept a statement the proof does not cover.

Callers that already check public_inputs.len() + 1 == vk.gamma_abc_g1.len() are unaffected. A proof still only attests to the statement it was created for; this is not a break of Groth16 soundness and it does not leak witness data. There is no fixed release (patched = []).

Truncation and zero-padding are the two directions of this one missing check, so this PR adds one advisory, not two.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate
  (not checked: upstream was asked about the bug, not about publishing an advisory, and has not answered)

[djc]

[ ] Asked maintainer(s) if publishing an advisory is appropriate
(not checked: upstream was asked about the bug, not about publishing an advisory, and has not answered)

For active maintainers, we defer to their judgement whether an advisory is appropriate; RustSec does not want to be a mechanism for bypassing maintainers.