PT-2026-42669 · Crates.Io · Nimiq-Primitives

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-46539

OSV

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact

A logic flaw in BlockInclusionProof::is block proven causes the function to return true without performing any cryptographic verification when get interlink hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification.

Patches

The patch for this vulnerability is formally released as part of v1.4.0.

Workarounds

No Workarounds

Resources

See PR.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-46539

GHSA-799F-29JM-GR6C

Affected Products

Nimiq-Primitives

References · 6

• https://osv.dev/vulnerability/GHSA-799f-29jm-gr6c · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/pull/3705 · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c · Note
• https://github.com/nimiq/core-rs-albatross/commit/cc5a1d54bbbffd1ea975bd2ee87d5f7b3b30bbf1 · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 · Note