PT-2026-34546 · Nimiq · Nimiq-Primitives

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-34065

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key. Hashing an election macro header hashes validators and reaches Validators::voting keys(), which calls validator.voting key.uncompress().unwrap() and panics on invalid bytes. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Fix

Improper Handling of Exceptional Conditions

Unchecked Return Value

Weakness Enumeration

CWE-755

CWE-252

Related Identifiers

CVE-2026-34065

Affected Products

Nimiq-Primitives

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34065 · Security Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7c4j-2m43-2mgh · Note
• https://github.com/nimiq/core-rs-albatross/pull/3662 · Note
• https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff · Note