Input Validation Flaw in Nimiq Blockchain Implementation from Nimiq

CVE-2026-34066

What is CVE-2026-34066?

The Nimiq Blockchain implementation has a vulnerability in the HistoryStore component where improper validation of historic transaction inputs can lead to a panic. Specifically, the method HistoryStore::put_historic_txns does not adequately enforce invariants regarding the block number of transactions, allowing an attacker to manipulate the input during history synchronization. This flaw can result in application stability issues, as the panic may occur before adequate rejection of malformed history lists, compromising the reliability of the blockchain. A fix is available in version 1.3.0, and there are no known workarounds to mitigate this issue.

References