nimiq core-rs-albatross up to 1.2.x nimiq Proof-of-Stake Protocol blockchain.history_store.history_index return value

Summaryinfo

A vulnerability has been found in nimiq core-rs-albatross up to 1.2.x and classified as problematic. Affected by this vulnerability is the function blockchain.history_store.history_index of the component nimiq Proof-of-Stake Protocol Handler. This manipulation causes return value. This vulnerability is tracked as CVE-2026-35468. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in nimiq core-rs-albatross up to 1.2.x. Affected by this vulnerability is the function blockchain.history_store.history_index of the component nimiq Proof-of-Stake Protocol Handler. The manipulation with an unknown input leads to a return value vulnerability. The CWE definition for the vulnerability is CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. As an impact it is known to affect availability. The summary by CVE is:

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-35468 since 04/02/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 0e5c90a6c75b722f3d6091769776a4040e694dba is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• nimiq

Name

• core-rs-albatross

Version

• 1.0
• 1.1
• 1.2

License

• open-source

Website

• Product: https://github.com/nimiq/core-rs-albatross/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion