RUSTSEC-2026-0004: Triton VM Soundness Vulnerability due to Improper Sampling of Randomness

What to do

1. See which version you have: cargo tree -i triton-vm (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p triton-vm. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example triton-vm = "2.0.0") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

In affected versions of Triton VM, the verifier failed to correctly sample randomness in the FRI sub-protocol.

Malicious provers can exploit this to craft proofs for arbitrary statements that this verifier accepts as valid, undermining soundness.

Protocols that rely on proofs and the supplied verifier of the affected versions of Triton VM are completely broken. Protocols implementing their own verifier might be unaffected.

The flaw was corrected in commit 3a045d63, where the relevant randomness is sampled correctly.

References

• Package: crates.io/crates/triton-vm
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0004.html

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for triton-vm

• VulnerabilityRUSTSEC-2021-0156 · 2021-06-11Triton VM Soundness Vulnerability due to Missing Constraint

Full security history of triton-vm