nimiq core-rs-albatross up to 1.2.x nimiq Proof-of-Stake Protocol verify_macro_block_proposal data authenticity

Summaryinfo

A vulnerability classified as problematic was found in nimiq core-rs-albatross up to 1.2.x. This affects the function verify_macro_block_proposal of the component nimiq Proof-of-Stake Protocol Handler. Executing a manipulation can lead to data authenticity. The identification of this vulnerability is CVE-2026-34061. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in nimiq core-rs-albatross up to 1.2.x. It has been declared as problematic. This vulnerability affects the function verify_macro_block_proposal of the component nimiq Proof-of-Stake Protocol Handler. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect integrity, and availability. CVE summarizes:

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept that proposal in verify_macro_block_proposal() because the proposal path validates header shape, successor relation, proposer, body root, and state, but never checks the interlink binding for election blocks. The same finalized block is later rejected by verify_block() during push with InvalidInterlink. Because validators prevote and precommit the malformed header hash itself, the failure happens after Tendermint decides the block, not before voting. This issue has been patched in version 1.3.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-34061 since 03/25/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 9d7d17c9163384e79f61cdbbfe9853ae57bb8bf7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• nimiq

Name

• core-rs-albatross

Version

• 1.0
• 1.1
• 1.2

License

• open-source

Website

• Product: https://github.com/nimiq/core-rs-albatross/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion