CVE-2026-34066
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In nimiq-blockchain before version 1.3.0, HistoryStore::put_historic_txns uses an assert! to enforce invariants about HistoricTransaction.block_number. During history sync, a peer can influence the input passed to Blockchain::push_history_sync, and a malformed history list can violate these invariants and trigger a panic before later rejection checks run.
Risk Assessment
A malicious peer could trigger a node panic during history sync, causing denial of service.
Recommendation
Upgrade nimiq-blockchain to version 1.3.0 or later; no known workarounds are available.
Other vulnerabilities in nimiq-blockchain
See all- CVE-2026-40094Medium
In the nimiq-blockchain library (versions 1.3.0 and prior), network discovery accepts signed PeerContact updates from untrusted peers and stores them in the contact book, potentially causing an address book crash. An attacker can send a contact with an empty address list, causing a panic when accessing the address book.
- CVE-2026-40092High
nimiq-blockchain prior to version 1.4.0 has a vulnerability where a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The record contains a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64, causing a panic when unwrap() is called in the Ed25519 implementation. The BLS implementation correctly returns false, but Ed25519 panics.
Original NVD description (English source)
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS