CVE-2026-34069
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic by sending a RequestMacroChain message where the first locator hash on the victim's main chain is a micro block hash instead of a macro block hash; this is fixed in version 1.3.0.
Risk Assessment
An unauthenticated p2p peer can trigger a node panic, causing denial of service or destabilizing network operation. The risk affects Nimiq node operators running vulnerable versions.
Recommendation
Update nimiq/core-rs-albatross to version 1.3.0 or later. Until updated, consider limiting node exposure to untrusted p2p peers.
Other vulnerabilities in nimiq/core-rs-albatross
See all- CVE-2026-28402High
In versions prior to 1.2.2, the nimiq/core-rs-albatross library has a vulnerability that allows a malicious or compromised validator to publish a macro block proposal with a mismatched `header.body_root`. This can lead to validator crashes due to verification mismatches.
- CVE-2026-34061Medium
nimiq/core-rs-albatross prior to version 1.3.0 contains a vulnerability where an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept the proposal because verify_macro_block_proposal() does not check the interlink binding for election blocks. The same finalized block is later rejected by verify_block() with InvalidInterlink, but this happens after Tendermint decides, potentially causing consensus issues.
- CVE-2026-33184High
In nimiq/core-rs-albatross (a Rust implementation of the Nimiq Proof-of-Stake protocol) prior to version 1.3.0, the handshake handler accepts a peer-supplied limit of 0 and stores it unchanged. In the HandshakeAck path, limit 0 returns zero contacts, appearing benign. Later, in the Established state, computing self.peer_list_limit.unwrap() as usize - 1 with limit 0 wraps to usize::MAX, causing a panic when attempting memory allocation.
Original NVD description (English source)
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. Sending a RequestMacroChain message where the first locator hash on the victim’s main chain is a micro block hash (not a macro block hash) causes said panic. The RequestMacroChain::handle handler selects the locator based only on "is on main chain", then calls get_macro_blocks() and panics via .unwrap() when the selected hash is not a macro block (BlockchainError::BlockIsNotMacro). This issue has been fixed in version 1.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS