Executive brief
A vulnerability in the Nimiq blockchain consensus library allows an unauthenticated attacker to crash a node by sending a specially crafted network message. This results in a denial-of-service (DoS) condition, potentially disrupting the node's ability to participate in the blockchain network and process transactions. The issue affects the Albatross implementation of the Nimiq protocol.
Technical details
A reachable assertion (CWE-617) exists in the `RequestMacroChain::handle` function of the `nimiq-consensus` crate. An unauthenticated P2P peer can send a `RequestMacroChain` message where the first locator hash on the victim's main chain corresponds to a micro block rather than a macro block. The handler fails to validate the block type before calling `get_macro_blocks()`, which subsequently triggers an `.unwrap()` on a `BlockchainError::BlockIsNotMacro` error, causing the task to panic. This vulnerability is fixed in version 1.3.0 of the Nimiq core-rs-albatross repository.
Affected products
- Nimiq nimiq-consensus <= 1.2.2
Timeline
- 2026-04-11: disclosed: Vulnerability reported to Nimiq
- 2026-04-13: advisory: GitHub Advisory GHSA-48m6-486p-9j8p published
- 2026-04-13: patched: Fix released in version 1.3.0