A flaw in the blst cryptographic library’s blst_sha256_bcopy assembly routine allows an out‑of‑bounds stack write due to a missing zero‑length guard. When a calling application supplies a zero‑length salt to key‑generation functions such as blst_keygen_v5(), the stack is corrupted and the process terminates immediately, providing a classic denial‑of‑service. Based on the description, it is inferred that any attacker who can invoke this functionality can force a crash.

The vulnerability affects the blst library maintained by supranational on GitHub. No specific version numbers are listed, so all releases in which this recipe exists are potentially impacted. Applications that embed this library and expose key‑generation functions are at risk.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% reflects a very low current exploitation probability. It is not catalogued in CISA’s KEV list. Exploitation requires remote or local access to a key‑generation API that accepts a zero‑length salt; without such exposure the risk is limited. The impact is limited to service interruption, as it does not provide confidentiality or integrity compromise.