CVE-2026-46539 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-46539

CVSS 5.9 · Medium EPSS 0,21%

Kerentanan Insufficient Verification of Data Authenticity. Skor CVSS 3.1 5.9 (Medium) menurut github.com.

Deskripsi (NVD)

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification. This issue has been patched in version 1.4.0.

Rincian

Terbit di NVD: 10 Juni 2026
Terakhir diubah: 23 Juli 2026
Status NVD: Deferred
CVSS 3.1: 5.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-345: Insufficient Verification of Data Authenticity
EPSS (30 hari): 0,21% peluang dieksploitasi; lebih tinggi dari 10,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.