# CVE-2026-46543: Nimiq core-rs-albatross denial of service via RequestBatchSet panic

Source: https://junglewise.ai/threats/cve-2026-46543-nimiq-core-rs-albatross-denial-of-service-via-requestbatchset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46543 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Nimiq is a blockchain protocol implementation used for processing cryptocurrency transactions. A vulnerability in the software allows a remote attacker to crash any full node on the network by sending a specially crafted message. This could lead to service disruptions and impact the stability of the blockchain network, though it does not expose private data.

Technologies: [nimiq-blockchain (crates.io)](https://junglewise.ai/threats/technologies/nimiq-blockchain). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-46543 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46543 being exploited in the wild.

**How severe is CVE-2026-46543?** Medium severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** nimiq-blockchain (crates.io) < 1.5.0, SEMVER:introduced=0,fixed=1.5.0.

**Is there a fix for CVE-2026-46543?** Yes. nimiq-blockchain (crates.io): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46543 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46543?** Check whether you run nimiq-blockchain (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nimiq-blockchain (crates.io): upgrade to 1.5.0 or later

  ```sh
  cargo update -p nimiq-blockchain
  ```


## Technical details

A reachable assertion (CWE-617) exists in the Nimiq Rust implementation (core-rs-albatross) prior to version 1.5.0. When a node receives a 'RequestBatchSet' message containing the genesis block's hash, the handler invokes 'get_epoch_chunks', which attempts to iterate backwards through macro blocks. The function 'Policy::macro_block_before' fails to handle the boundary condition of the genesis block and triggers a panic with the message 'No macro blocks before genesis block'. This allows an unauthenticated remote attacker to cause a denial-of-service (DoS) by crashing the node process. The issue is resolved in version 1.5.0.

## Affected products

- Nimiq nimiq-blockchain (core-rs-albatross) <= v1.4.0

## Identifiers

- CVE-2026-46543
- GHSA-vghx-352f-93jm

## Timeline

- 2026-05-06: patched: Fix merged in pull request 3745
- 2026-05-07: advisory: Release v1.5.0 published
- 2026-05-15: disclosed: GitHub Security Advisory published
- 2026-06-10: advisory: NVD published CVE-2026-46543

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3745](https://github.com/nimiq/core-rs-albatross/pull/3745)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vghx-352f-93jm](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vghx-352f-93jm)

## Related threats

- [Nimiq nimiq-blockchain off-by-one error in validity store](https://junglewise.ai/threats/cve-2026-46369-nimiq-nimiq-blockchain-off-by-one-error-in-validity-store)
- [nimiq-blockchain: Peer-triggerable panic during history sync](https://junglewise.ai/threats/cve-2026-34066-nimiq-blockchain-peer-triggerable-panic-during-history-sync)
- [Nimiq nimiq-blockchain missing upper bound on block timestamps](https://junglewise.ai/threats/cve-2026-40093-nimiq-nimiq-blockchain-missing-upper-bound-on-block-timestamps)