CVE-2026-35468: Nimiq core-rs-albatross denial of service via history index panic

CVE-2026-35468 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Nimiq core-rs-albatross is a Rust-based implementation of the Nimiq blockchain protocol. A vulnerability exists where a remote user can crash a blockchain node by sending specific network requests while the node is syncing or running without a history index. This results in a denial-of-service, potentially disrupting the node's ability to participate in the network or process transactions.

Technologies: Nimiq Albatross, Nimiq Proof-Of-Stake. Vendors: Nimiq.

Quick answers

Is CVE-2026-35468 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35468 being exploited in the wild.
How severe is CVE-2026-35468?
Medium severity, with a CVSS score of 5.3, published 3 April 2026.
Which products and versions are affected?
Nimiq Albatross < 1.3.0.
Is there a fix for CVE-2026-35468?
A patch was published on 2026-03-27: Fixed in commit 0e5c90a and PR #3667 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35468 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-35468?
Check whether you run Nimiq Albatross or Nimiq Proof-Of-Stake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in Nimiq core-rs-albatross due to an unchecked return value in the consensus request handlers. Specifically, the handlers for 'RequestTransactionsProof' and 'RequestTransactionReceiptsByAddress' call 'blockchain.history_store.history_index().unwrap()' directly. Because 'HistoryStoreProxy::history_index()' returns 'None' when a node is in the 'WithoutIndex' state (such as during syncing), this call triggers an 'Option::unwrap()' panic. A remote, unauthenticated peer can exploit this by sending these specific requests to a target node, causing the process to crash. The issue is fixed in version 1.3.0 by implementing guard clauses that return an error instead of panicking.

Affected products

  • Nimiq core-rs-albatross < 1.3.0

Timeline

  • 2026-03-27: patched: Fixed in commit 0e5c90a and PR #3667
  • 2026-03-27: advisory: GitHub Security Advisory GHSA-xr78-2jhh-9wf9 published
  • 2026-04-03: disclosed: CVE-2026-35468 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.