TI-2026-34222 Aliases CVE-2026-46543 GHSA-vghx-352f-93jm

nimiq-blockchain: Genesis batch set request

LOW 30CWE-617Published 2026-06-09 · Updated 2026-06-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-617.

Summary

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks using Policy::macro_block_before. When it reaches the genesis block number, macro_block_before panics with "No macro blocks before genesis block". This issue has been patched in version 1.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00291 21st percentileScored 2026-11-07

Fix Fixed core-rs-albatross (nimiq): 1.5.0nimiq-blockchain (crates.io): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nimiq	core-rs-albatross	before 1.5.0	1.5.0	Patch available	CNA
—	nimiq-blockchain (crates.io)	before 1.5.0	1.5.0	Patch available	GHSA-vghx-352f-93jm

core-rs-albatross Vendornimiq Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
nimiq-blockchain (crates.io) Vendor— Affected before 1.5.0 Fixed in 1.5.0 Patch available GHSA-vghx-352f-93jm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:nimiq:nimiq_proof-of-stake::::::::	—	—	nimiq

cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:* Versions — — ·nimiq

Remediation

Fix · CNA core-rs-albatross (nimiq) Fixed in 1.5.0
Fix · GHSA-vghx-352f-93jm nimiq-blockchain (crates.io) Fixed in 1.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-46543
2026-10-03 Alias added: GHSA-vghx-352f-93jm

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-46543

Other 5

TI-2026-26389 nimiq-account: Vesting insufficient funds error can panic CVSS 3.1HIGH 8.2
TI-2026-25867 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation CVSS 3.1CRITICAL 9.6
TI-2026-34086 Nimiq: Validity store off by one error CVSS 3.1HIGH 7.5
TI-2026-28920 nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT CVSS 3.1HIGH 7.5
TI-2025-29800 nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability CVSS 3.1HIGH 7.5
TI-2026-34224 nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item CVSS 3.1HIGH 7.5

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences