CVE-2026-34065 — Vulnerability in nimiq-primitives — CVE Details

HIGH

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

Published April 22, 2026Updated May 5, 2026Source: osv

Summary

### Impact An untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` set contains an invalid compressed BLS voting key. Hashing an election macro header hashes `validators` and reaches `Validators::voting_keys()`, which calls `validator.voting_key.uncompress().unwrap()` and panics on invalid bytes. ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff) is included as part of [v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0). ### Workarounds No known workarounds.

Advisory Timeline

First published April 22, 2026 (173 days ago).
Last revised May 5, 2026 — 13 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
nimiq-primitives	crates.io	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-252
View on MITRE
CWE-755
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Frequently Asked Questions

What is CVE-2026-34065?: nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-34065?: CVE-2026-34065 affects nimiq-primitives. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34065 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-7c4j-2m43-2mgh

Related CVEs

CVE-2026-93657
HIGH
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
CVE-2026-18140
HIGH
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
CVE-2026-46545
HIGH
nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
CVE-2026-46539
MEDIUM
nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies