PT-2026-31733 · Nimiq · Nimiq-Blockchain

Published 2026-04-09 · Updated 2026-04-19 · CVE-2026-40093

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions nimiq-blockchain versions 1.3.0 and earlier

Description nimiq-blockchain, used for persistent block storage in Nimiq's Rust implementation, has an issue where block timestamp validation lacks an upper bound check against the wall clock in versions 1.3.0 and earlier. A malicious block-producing validator can set block timestamps arbitrarily far into the future. This impacts reward calculations via the Policy::supply at() and batch delay() functions in the blockchain/src/reward.rs file, potentially inflating the monetary supply beyond the intended emission schedule.

Recommendations Update to a version later than 1.3.0.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-1284

Related Identifiers

CVE-2026-40093

GHSA-49XC-52MP-CC9J

Affected Products

Nimiq-Blockchain

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-40093 · Security Note
• https://osv.dev/vulnerability/GHSA-49xc-52mp-cc9j · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j · Note
• https://twitter.com/CVEnew/status/2042355095984013723 · Twitter Post
• https://twitter.com/giuseppe_1337/status/2045695319514501346 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1skdkn8/resumen_diario_de_vulnerabilidades_13042026 · Reddit Post