Loading...
Skip to main content
GeekWala

CVE-2026-46539 — Vulnerability in nimiq-primitives — CVE Details

MEDIUM

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

Published May 21, 2026Updated June 10, 2026Source: osv

Summary

### Impact A logic flaw in `BlockInclusionProof::is_block_proven` causes the function to return true without performing any cryptographic verification when `get_interlink_hops` yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification. ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3705) is formally released as part of [v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0). ### Workarounds No Workarounds ### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3705).

Advisory Timeline

  • First published May 21, 2026 (144 days ago).
  • Last revised June 10, 2026 — 20 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
nimiq-primitives
crates.io
All versionsRange-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-345
    Insufficient Verification of Data AuthenticityMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-46539?
nimiq-primitives: BlockInclusionProof interlink issue when hops are empty This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.9/10).
How do I check if my project is affected by CVE-2026-46539?
CVE-2026-46539 affects nimiq-primitives. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-46539 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
5.9

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-799f-29jm-gr6c

Related CVEs

  • CVE-2026-34065
    HIGH

    nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

  • CVE-2026-46545
    HIGH

    nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

  • CVE-2026-102821
    MEDIUM

    Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey

  • CVE-2026-102820
    MEDIUM

    pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies