CVE-2026-34067

LowCVSS 3.1

Published: 22/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

In nimiq-transaction prior to version 1.3.0, HistoryTreeProof::verify panics on a malformed proof where history.len() != positions.len() due to assert_eq!. The proof object is derived from untrusted p2p responses (ResponseTransactionsProof.proof) and is attacker-controlled. A malicious peer could trigger a crash by returning a crafted inclusion proof.

Risk Assessment

A remote attacker can crash a node over the p2p network, causing denial of service. This affects availability of the Rust Nimiq implementation.

Recommendation

Update nimiq-transaction to version 1.3.0 or later. No known workarounds — updating is the only fix.

Other vulnerabilities in nimiq-transaction

CVE-2026-34068Medium
nimiq-transaction prior to version 1.3.0 allows UpdateValidator transactions that set a new voting key without the required proof-of-knowledge. Skipping this requirement enables BLS rogue-key attacks on key aggregation, potentially allowing an attacker to forge a quorum-looking Tendermint block justification with a single signature. Exploitability is low because it requires knowledge of the next epoch validator set chosen via VRF.

Original NVD description (English source)

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() != positions.len()` due to `assert_eq!(history.len(), positions.len())`. The proof object is derived from untrusted p2p responses (`ResponseTransactionsProof.proof`) and is therefore attacker-controlled at the network boundary until validated. A malicious peer could trigger a crash by returning a crafted inclusion proof with a length mismatch. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS