CVE-2026-34066

{"id": "CVE-2026-34066", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34066", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T12:56:55.597573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nimiq", "product": "nimiq-blockchain", "versions": [{"status": "affected", "version": "< 1.3.0"}]}]}], "published": "2026-04-22T20:16:41.237", "references": [{"url": "https://github.com/nimiq/core-rs-albatross/commit/6f5511309c199d84b012fe6b9aba7e5582892c50", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/pull/3656", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-j99g-7rqw-q9jg", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-617"}, {"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available."}, {"lang": "es", "value": "nimiq-blockchain proporciona almacenamiento persistente de bloques para la implementaci\u00f3n en Rust de Nimiq. Antes de la versi\u00f3n 1.3.0, \u2019HistoryStore::put_historic_txns\u2019 utiliza un \u2019assert!\u2019 para hacer cumplir invariantes sobre \u2019HistoricTransaction.block_number\u2019 (debe estar dentro del macrobloque que se est\u00e1 insertando y dentro de la misma \u00e9poca). Durante la sincronizaci\u00f3n del historial, un par puede influir en la entrada \u2019history: &[HistoricTransaction]\u2019 pasada a \u2019Blockchain::push_history_sync\u2019, y una lista de historial malformada puede violar estas invariantes y desencadenar un p\u00e1nico. \u2019extend_history_sync\u2019 llama a \u2019this.history_store.add_to_history(..)\u2019 antes de comparar la ra\u00edz del historial calculada con la cabecera del macrobloque (\u2019block.history_root()\u2019), por lo que el p\u00e1nico puede ocurrir antes de que se ejecuten las comprobaciones de rechazo posteriores. El parche para esta vulnerabilidad est\u00e1 incluido como parte de la v1.3.0. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "CD0CAAD1-7626-4A4A-A6F8-9DC46FE50731", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}