Executive brief
Nimiq is a blockchain protocol implementation used for processing cryptocurrency transactions. A vulnerability in the software allows a remote attacker to crash any full node on the network by sending a specially crafted message. This could lead to service disruptions and impact the stability of the blockchain network, though it does not expose private data.
Technical details
A reachable assertion (CWE-617) exists in the Nimiq Rust implementation (core-rs-albatross) prior to version 1.5.0. When a node receives a 'RequestBatchSet' message containing the genesis block's hash, the handler invokes 'get_epoch_chunks', which attempts to iterate backwards through macro blocks. The function 'Policy::macro_block_before' fails to handle the boundary condition of the genesis block and triggers a panic with the message 'No macro blocks before genesis block'. This allows an unauthenticated remote attacker to cause a denial-of-service (DoS) by crashing the node process. The issue is resolved in version 1.5.0.
Affected products
- Nimiq nimiq-blockchain (core-rs-albatross) <= v1.4.0
Timeline
- 2026-05-06: patched: Fix merged in pull request 3745
- 2026-05-07: advisory: Release v1.5.0 published
- 2026-05-15: disclosed: GitHub Security Advisory published
- 2026-06-10: advisory: NVD published CVE-2026-46543