Nimiq Light Blockchain Vulnerability in the Rust Implementation of Proof-of-Stake Protocol
CVE-2026-46540

6.5MEDIUM

Key Information:

Vendor

Nimiq

Status
Core-rs-albatross
Vendor
CVE Published:
9 June 2026

What is CVE-2026-46540?

The Nimiq Light Blockchain, a Rust-based implementation of the Proof-of-Stake protocol, exhibits a vulnerability where a fork chain update does not correctly synchronize critical blockchain state components. Specifically, when adopting a macro block, the state variables such as self.macro_head and self.election_head are not updated, leading to verification issues for subsequent macro blocks. This inconsistency can cause significant chain progression interruptions for light clients, particularly if the rebranch target was an election block. A patch is available in version 1.4.0 to address these issues.

Affected Version(s)

core-rs-albatross < 1.4.0

References

https://github.com/nimiq/core-rs-albatross/security/advis...
x_refsource_CONFIRM
https://github.com/nimiq/core-rs-albatross/pull/3706
x_refsource_MISC
https://github.com/nimiq/core-rs-albatross/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.