PT-2026-42671 · Git+2 · Core-Rs-Albatross+1

CVE-2026-46543 · Published 2026-05-21 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.5.0

Description A remote peer can cause a full node to crash by sending a RequestBatchSet message that includes the hash of the genesis block. This occurs because the handler invokes the get epoch chunks() function, which iterates backward through macro blocks using Policy::macro block before. Upon reaching the genesis block number, the macro block before() function triggers a panic with the message "No macro blocks before genesis block".

Recommendations Update to version 1.5.0.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-46543

GHSA-VGHX-352F-93JM

Affected Products

Core-Rs-Albatross

Nimiq-Blockchain

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46543.json · Exploit
• https://osv.dev/vulnerability/GHSA-vghx-352f-93jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-46543 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46543 · Security Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vghx-352f-93jm · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0 · Note
• https://github.com/nimiq/core-rs-albatross/pull/3745 · Note
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/commit/8e8b0abdb1b66f5e9b25b3833879f05c173a5596 · Note
• https://t.me/CVEtracker/56388 · Telegram Post