GitHub Advisoryadvisory · crates.io
GHSA-799f-29jm-gr6c nimiq-primitives: BlockInclusionProof interlink issue when hops are empty
MEDIUM
Official page ↗
- Aliases
- CVE-2026-46539
- Ecosystem
- crates.io
- Packages
- nimiq-primitives
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-345
- Reviewed
- 2026-05-21
Affected packages
• crates.io nimiq-primitives: <= 0.2.0 (no fix yet)
Description
Impact
A logic flaw in `BlockInclusionProof::is_block_proven` causes the function to return true without performing any cryptographic verification when `get_interlink_hops` yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification.
Patches
The patch for this vulnerability is formally released as part of v1.4.0.
Workarounds
No Workarounds
Resources
See PR.
Related
Alias · CVE (1)
- CVE-2026-46539 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. vulnerability
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c web
- https://nvd.nist.gov/vuln/detail/CVE-2026-46539 advisory
- https://github.com/nimiq/core-rs-albatross/pull/3705 web
- https://github.com/nimiq/core-rs-albatross/commit/cc5a1d54bbbffd1ea975bd2ee87d5f7b3b30bbf1 web
- https://github.com/nimiq/core-rs-albatross package
- https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 web