Skip to content
Heist/ feed
Back to feed
Critical

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

Type: advisorySources: OSV

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Prior to version 1.3.0, if an attacker can get a `SkipBlockProof` verified where `MultiSignature.signers` contains out-of-range indices spaced by 65536, these indices inflate `len()` but collide onto the same in-range `u16` slot during aggregation. This makes it possible for a malicious validator with far fewer than `2f+1` real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-33471
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 16:44 UTC · Revision 1

Source evidence

nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

core-osv · Original source

Published 22 Apr 2026, 19:13 UTC

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Prior to version 1.3.0, if an attacker can get a `SkipBlockProof` verified where `MultiSignature.signers` contains out-of-range indices spaced by 65536, these indices inflate `len()` but collide onto the same in-range `u16` slot during aggregation. This makes it possible for a malicious validator with far fewer than `2f+1` real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

osv:CVE-2026-33471
Complete source record
{
  "id": "21350b42f769bc45ff52c0d7e6b6463f2c80337e4d2adca9098100d08ad885a9",
  "url": "https://osv.dev/vulnerability/CVE-2026-33471",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation",
    "summary": "nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Prior to version 1.3.0, if an attacker can get a `SkipBlockProof` verified where `MultiSignature.signers` contains out-of-range indices spaced by 65536, these indices inflate `len()` but collide onto the same in-range `u16` slot during aggregation. This makes it possible for a malicious validator with far fewer than `2f+1` real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.",
    "evidence": "osv:CVE-2026-33471",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-33471",
      "aliases": [
        "CVE-2026-33471",
        "GHSA-6973-8887-87ff"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nimiq/core-rs-albatross",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5bd15d9af710abeecdfb63d0a721dc883efb59c4"
                },
                {
                  "fixed": "d02059053181ed8ddad6b59a0adfd661ef5cd823"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.3.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d02059053181ed8ddad6b59a0adfd661ef5cd823"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5bd15d9af710abeecdfb63d0a721dc883efb59c4"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.3.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-rc.5",
            "v1.0.0-rc.4",
            "v1.0.0-rc.3",
            "v1.0.0-rc.2",
            "v1.0.0-rc.1",
            "v1.0.0-rc.0",
            "v0.24.4",
            "v0.24.3",
            "v0.24.2",
            "v0.24.1",
            "v0.24.0",
            "v0.23.0",
            "v0.22.3",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.1",
            "v0.21.0",
            "v0.20.5",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.1",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.1",
            "v0.12.0",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.0",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.0",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.0",
            "v0.1.0-rc.3",
            "v0.1.0-rc.2",
            "v0.1.0-rc.1",
            "v0.1.0-rc.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33471.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.754137873Z",
      "provider": "osv",
      "references": [
        "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33471.json",
        "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-6973-8887-87ff",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33471",
        "https://github.com/nimiq/core-rs-albatross/commit/d02059053181ed8ddad6b59a0adfd661ef5cd823"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1284",
          "CWE-190",
          "CWE-20",
          "CWE-345"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33471.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-33471",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497523,
  "published_at": "2026-04-22T19:13:04.687+00:00"
}