CVE-2026-34069 json
nimiq-consensus panics via RequestMacroChain micro-block locator
published 2026-04-13 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-22160 , GHSA-48m6-486p-9j8p
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. Sending a RequestMacroChain message where the first locator hash on the victim’s main chain is a micro block hash (not a macro block hash) causes said panic. The RequestMacroChain::handle handler selects the locator based only on "is on main chain", then calls get_macro_blocks() and panics via .unwrap() when the selected hash is not a macro block (BlockchainError::BlockIsNotMacro). This issue has been fixed in version 1.3.0.
Patch / fix
- nimiq core-rs-albatross 1.3.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | nimiq-consensus | <=1.2.2 |
no fix listed |
Affected products
- nimiq core-rs-albatross
Classification
- Weakness
-
- CWE-617 Reachable Assertion
References
-
github.com
/nimiq/core-rs-albatross/pull/3660
web, issue-tracking, patch
-
github.com
/nimiq/core-rs-albatross/commit/ae6c1e92342e72f80fd12accbe66ee80dd6802ac
web, patch
-
github.com
/nimiq/core-rs-albatross/security/advisories/GHSA-48m6-486p-9j8p
web, patch, vendor-advisory
-
github.com
/nimiq/core-rs-albatross/releases/tag/v1.3.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-34069
advisory
-
github.com
/nimiq/core-rs-albatross
package
Sources
- CVE List CVE-2026-34069
- GitHub Advisory GHSA-48m6-486p-9j8p
- NVD CVE-2026-34069
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.