GitHub Advisoryadvisory · crates.io

GHSA-j99g-7rqw-q9jg nimiq-blockchain: Peer-triggerable panic during history sync

MEDIUM Published 2026-04-22 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-34066
Ecosystem
crates.io
Packages
nimiq-blockchain
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-20, CWE-617, CWE-754
Reviewed
2026-04-22

Affected packages

• crates.io nimiq-blockchain: <= 0.2.0 (no fix yet)

Description

Impact `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. Patches The patch for this vulnerability is included as part of v1.3.0. Workarounds No known workarounds.

Related

Alias · CVE (1)

  • CVE-2026-34066 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. vulnerability

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-617 Reachable Assertion weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References