CVE-2026-34065

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Unchecked Return Value pada nimiq proof-of-stake. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` set contains an invalid compressed BLS voting key. Hashing an election macro header hashes `validators` and reaches `Validators::voting_keys()`, which calls `validator.voting_key.uncompress().unwrap()` and panics on invalid bytes. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-252: Unchecked Return Value
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7c4j-2m43-2mgh patch · advisory vendor
• https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff patch
• https://github.com/nimiq/core-rs-albatross/pull/3662 issue tracking · patch
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 release notes