CVE-2026-34066

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Improper Input Validation pada nimiq proof-of-stake. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-617: Reachable Assertion
CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-j99g-7rqw-q9jg patch · advisory vendor
• https://github.com/nimiq/core-rs-albatross/commit/6f5511309c199d84b012fe6b9aba7e5582892c50 patch
• https://github.com/nimiq/core-rs-albatross/pull/3656 issue tracking · patch
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 release notes