Panic in Nimiq Proof-of-Stake Implementation Due to Unauthenticated Peer Issue

CVE-2026-34069

What is CVE-2026-34069?

The Nimiq core-rs-albatross implementation of the Proof-of-Stake protocol is vulnerable to a panic condition when an unauthenticated peer sends a specific RequestMacroChain message. This occurs when the first locator hash on the victim's main chain is incorrectly identified as a micro block hash rather than a macro block hash. The panic results from the handler's reliance on the main chain check without verifying the type of block, leading to a failure in processing that can impact the stability of the blockchain. This issue has been addressed in version 1.3.0.

References