CVE-2026-34061
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
nimiq/core-rs-albatross prior to version 1.3.0 contains a vulnerability where an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept the proposal because verify_macro_block_proposal() does not check the interlink binding for election blocks. The same finalized block is later rejected by verify_block() with InvalidInterlink, but this happens after Tendermint decides, potentially causing consensus issues.
Risk Assessment
The risk involves potential disruption of network consensus, which could lead to chain forks or loss of funds.
Recommendation
Immediately upgrade to version 1.3.0, which includes a fix for this vulnerability.
Other vulnerabilities in nimiq/core-rs-albatross
See all- CVE-2026-28402High
In versions prior to 1.2.2, the nimiq/core-rs-albatross library has a vulnerability that allows a malicious or compromised validator to publish a macro block proposal with a mismatched `header.body_root`. This can lead to validator crashes due to verification mismatches.
- CVE-2026-33184High
In nimiq/core-rs-albatross (a Rust implementation of the Nimiq Proof-of-Stake protocol) prior to version 1.3.0, the handshake handler accepts a peer-supplied limit of 0 and stores it unchanged. In the HandshakeAck path, limit 0 returns zero contacts, appearing benign. Later, in the Established state, computing self.peer_list_limit.unwrap() as usize - 1 with limit 0 wraps to usize::MAX, causing a panic when attempting memory allocation.
Original NVD description (English source)
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept that proposal in verify_macro_block_proposal() because the proposal path validates header shape, successor relation, proposer, body root, and state, but never checks the interlink binding for election blocks. The same finalized block is later rejected by verify_block() during push with InvalidInterlink. Because validators prevote and precommit the malformed header hash itself, the failure happens after Tendermint decides the block, not before voting. This issue has been patched in version 1.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS