PT-2026-34546 · Unknown · Nimiq-Primitives

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-34065

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions nimiq-primitives versions prior to 1.3.0

Description An untrusted p2p peer can cause a node to panic by announcing an election macro block where the validators set contains an invalid compressed BLS voting key. This occurs because hashing an election macro header processes validators and triggers the Validators::voting keys() function, which subsequently calls validator.voting key.uncompress().unwrap(). The process panics when it encounters invalid bytes.

Recommendations Update to version 1.3.0.

Fix

Improper Handling of Exceptional Conditions

Unchecked Return Value

Weakness Enumeration

CWE-755

CWE-252

Related Identifiers

CVE-2026-34065

GHSA-7C4J-2M43-2MGH

Affected Products

Nimiq-Primitives

References · 8

• https://github.com/nimiq/core-rs-albatross/pull/3662 · Patch
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7c4j-2m43-2mgh · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff · Patch
• https://osv.dev/vulnerability/GHSA-7c4j-2m43-2mgh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34065 · Security Note
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://twitter.com/CVEnew/status/2047359956962218054 · Twitter Post