PT-2026-34547 · Nimiq · Nimiq-Blockchain

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-34066

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, HistoryStore::put historic txns uses an assert! to enforce invariants about HistoricTransaction.block number (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the history: &[HistoricTransaction] input passed into Blockchain::push history sync, and a malformed history list can violate these invariants and trigger a panic. extend history sync calls this.history store.add to history(..) before comparing the computed history root against the macro block header (block.history root()), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Fix

Improper Check for Exceptional Conditions

Assertion Failure

RCE

Weakness Enumeration

CWE-754

CWE-617

CWE-20

Related Identifiers

CVE-2026-34066

Affected Products

Nimiq-Blockchain

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34066 · Security Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://github.com/nimiq/core-rs-albatross/pull/3656 · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-j99g-7rqw-q9jg · Note
• https://github.com/nimiq/core-rs-albatross/commit/6f5511309c199d84b012fe6b9aba7e5582892c50 · Note