CVE-2026-35468

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.

• CWE-252

• https://github.com/nimiq/core-rs-albatross/commit/0e5c90a6c75b722f3d6091769776a4040e694dbaPatch
• https://github.com/nimiq/core-rs-albatross/pull/3667Patch
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0Release Notes
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-xr78-2jhh-9wf9Vendor Advisory

Published

Apr 3, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35462Papra is a minimalistic document management and archiving pl…4.3
• CVE-2026-35463pyLoad is a free and open-source download manager written in…8.8
• CVE-2026-35464pyLoad is a free and open-source download manager written in…7.5
• CVE-2026-35465SecureDrop Client is a desktop app for journalists to secure…7.5
• CVE-2026-35466XSS vulnerability in cveInterface.js allows for inject HTML …6.1
• CVE-2026-35467The stored API keys in temporary browser client is not marke…7.5
• CVE-2026-35469spdystream is a Go library for multiplexing streams over SPD…8.7
• CVE-2026-3547Out-of-bounds read in ALPN parsing due to incomplete validat…7.5
• CVE-2026-35470OpenSTAManager is an open source management software for tec…8.8
• CVE-2026-35471goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-35472WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35473WeGIA is a Web manager for charitable institutions. Prior to…6.1