{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.5.2"}],"component":"p3-symmetric","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-3g92-f9ch-qjcm","id":"tcs_01M5KERXN6KAGC30ZH2HJN5DAF","modified_at":"2026-04-16T23:04:45.978452Z","published_at":"2026-04-16T22:52:41Z","references":["https://osv.dev/vulnerability/GHSA-3g92-f9ch-qjcm","https://github.com/Plonky3/Plonky3/security/advisories/GHSA-3g92-f9ch-qjcm","https://github.com/Plonky3/Plonky3/commit/5c1dc1d64c0516a8911bbf3ea40f173c21d6ae47","https://github.com/Plonky3/Plonky3"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-3g92-f9ch-qjcm","url":"https://osv.dev/vulnerability/GHSA-3g92-f9ch-qjcm"}],"summary":"Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths"}