CVE-2025-30147 – ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve

https://notcve.org/view.php?id=CVE-2025-30147

07 May 2025 — Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 through 25.2.2, corresponding to besu-native versions 0.9.0 through 1.2.1, have a potential consensus bug for the precompiles ALTBN128_ADD (0x06), ALTBN128_MUL (0x07), and ALTBN128_PAIRING (0x08). These precompiles were reimplemented in besu-native using gnark-crypto's bn254 implementation, as the former implementation used a library which was no longer ma... • https://github.com/hyperledger/besu-native/security/advisories/GHSA-jcp8-gh74-97hq • CWE-325: Missing Cryptographic Step •