Transaction Primitive Vulnerability in Nimiq's Rust Implementation

CVE-2026-34067

What is CVE-2026-34067?

The Nimiq transaction primitive, used in Nimiq's Rust implementation, contains a vulnerability that may lead to crashes under certain conditions. Specifically, the HistoryTreeProof::verify function can panic when it encounters a malformed proof, where the lengths of the history and positions do not match. This vulnerability arises from untrusted p2p responses, allowing a malicious peer to exploit this issue by sending a crafted inclusion proof. The defect was addressed in version 1.3.0, eliminating the panic by ensuring proper validation of input proofs.

References