CVE-2026-46539: Nimiq BlockInclusionProof cryptographic bypass in nimiq-primitives

CVE-2026-46539 · Severity: medium · CVSS 5.9 · Published 2026-06-10

Nimiq is a blockchain protocol implemented in Rust. A logic error in how the system verifies block inclusion proofs allows an attacker to bypass security checks for specific types of blocks. This could allow a malicious actor to forge block headers and have them accepted as valid without the required cryptographic signatures, potentially compromising the integrity of transaction data.

Technologies: nimiq-primitives (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-46539 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46539 being exploited in the wild.
How severe is CVE-2026-46539?
Medium severity, with a CVSS score of 5.9, published 10 June 2026.
Which products and versions are affected?
nimiq-primitives (crates.io) <= 0.2.0, SEMVER:introduced=0,last_affected=0.2.0.
Is there a fix for CVE-2026-46539?
A patch was published on 2026-04-22: Fix merged in pull request 3705 and released in v1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46539 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46539?
Check whether you run nimiq-primitives (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic flaw exists in the `BlockInclusionProof::is_block_proven` function within the `nimiq-primitives` crate. When the `get_interlink_hops` function returns an empty list—which occurs when a target block is at the election block position immediately preceding the election head's epoch—the verification function returns `true` without performing any cryptographic hash or signature checks. An attacker can exploit this by providing forged transaction inclusion proofs containing a fabricated MacroBlock header for that specific epoch position. The vulnerability is reachable over the network but requires high attack complexity to align the forged data with the specific epoch state. The issue is fixed in version 1.4.0.

Affected products

  • Nimiq nimiq-primitives <= 1.3.0

Identifiers

  • CVE-2026-46539
  • GHSA-799f-29jm-gr6c

Timeline

  • 2026-04-22: patched: Fix merged in pull request 3705 and released in v1.4.0
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-799f-29jm-gr6c published
  • 2026-06-10: disclosed: CVE-2026-46539 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.