PT-2026-22404 · Unknown · Nimiq/Core-Rs-Albatross

1Seal · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-28402

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions nimiq/core-rs-albatross versions prior to 1.2.2

Description A malicious or compromised validator, if elected as a proposer, could publish a macro block proposal where the header.body root does not match the actual macro body hash. Proposal verification may pass due to validation of the header without validating the binding between body root and the hash of the body. Subsequent code expecting this binding may panic and crash validators. This issue only affects validator nodes. The vulnerable component is the macro block proposal verification path. The header.body root and hash(body) are key variables involved in this issue.

Recommendations Update to version 1.2.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2026-28402

GHSA-7WH6-RMXX-WW47

Affected Products

Nimiq/Core-Rs-Albatross

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28402.json · Exploit
• https://github.com/nimiq/core-rs-albatross/commit/6454c26d966858c5520f55739a30b94c17656c85 · Patch
• https://github.com/nimiq/core-rs-albatross/pull/3623 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28402 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28402 · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7wh6-rmxx-ww47 · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.2.2 · Note
• https://t.me/CVEtracker/46018 · Telegram Post
• https://t.me/cveNotify/153592 · Telegram Post
• https://twitter.com/CVEnew/status/2027744232849457357 · Twitter Post
• https://twitter.com/cracbot/status/2029150068163658002 · Twitter Post