CVE-2026-34069
Last modified
CVE-2026-34069 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. Sending a RequestMacroChain message where the first locator hash on the victim’s main chain is a micro block hash (not a macro block hash) causes said panic. The RequestMacroChain::handle handler selects the locator based only on "is on main chain", then calls get_macro_blocks() and panics via .unwrap() when the selected hash is not a macro block (BlockchainError::BlockIsNotMacro). This issue has been fixed in version 1.3.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nimiq | Nimiq Proof-Of-Stake | < 1.3.0 |
References
- https://github.com/nimiq/core-rs-albatross/pull/3660Issue Tracking, Patch
- https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-48m6-486p-9j8pPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-34069?
How severe is CVE-2026-34069?
How do I fix CVE-2026-34069?
Are you affected by CVE-2026-34069?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST