CVE-2026-34064

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance < min_cap`, but it constructs the error using `balance: self.balance - min_cap`. `Coin::sub` panics on underflow, so if an attacker can reach a state where `min_cap > balance`, the node crashes while trying to return an error. The `min_cap > balance` precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding `total_amount` without validating `total_amount <= transaction.value` (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

• CWE-191

• https://github.com/nimiq/core-rs-albatross/commit/4d01946f0b3d6c6e31786f91cdfb3eb902908da0Patch
• https://github.com/nimiq/core-rs-albatross/pull/3658Issue Tracking, Patch
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0Release Notes
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vc34-39q2-m6q3Patch, Vendor Advisory

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34059Buffer Over-read vulnerability in Apache HTTP Server. This …7.5
• CVE-2026-3406A vulnerability was found in projectworlds Online Art Galler…9.8
• CVE-2026-34060Ruby LSP is an implementation of the language server protoco…9.8
• CVE-2026-34061nimiq/core-rs-albatross is a Rust implementation of the Nimi…6.5
• CVE-2026-34062nimiq-libp2p is a Nimiq network implementation based on libp…5.3
• CVE-2026-34063Nimiq's network-libp2p is a Nimiq network implementation bas…7.5
• CVE-2026-34065nimiq-primitives contains primitives (e.g., block, account, …7.5
• CVE-2026-34066nimiq-blockchain provides persistent block storage for Nimiq…5.3
• CVE-2026-34067nimiq-transaction provides the transaction primitive to be u…6.5
• CVE-2026-34068nimiq-transaction provides the transaction primitive to be u…6.8
• CVE-2026-34069nimiq/core-rs-albatross is a Rust implementation of the Nimi…5.3
• CVE-2026-3407A vulnerability was determined in YosysHQ yosys up to 0.62. …3.3