Denial of Service Vulnerability in Nimiq's Rust Implementation
CVE-2026-34065
7.5HIGH
What is CVE-2026-34065?
A denial of service vulnerability exists in Nimiq's Rust implementation within the nimiq-primitives package. Prior to version 1.3.0, the system can be forced to panic by an untrusted peer announcing an election macro block with an invalid compressed BLS voting key. This occurs during the hashing process of an election macro header which integrates the validators data. The operation attempts to call validator.voting_key.uncompress().unwrap(), leading to a panic when the bytes are invalid. The issue has been addressed in version 1.3.0; however, no workarounds are currently available.
Affected Version(s)
nimiq-primitives < 1.3.0