Skip to content
Heist/ feed
Back to feed
Medium

nimiq-blockchain: Peer-triggerable panic during history sync

Type: advisorySources: OSV

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-34066
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 16:25 UTC · Revision 1

Source evidence

nimiq-blockchain: Peer-triggerable panic during history sync

core-osv · Original source

Published 22 Apr 2026, 19:47 UTC

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.

osv:CVE-2026-34066
Complete source record
{
  "id": "3e414a1845216e4f6ecfe2f518e5e33048ec0905b903ce09d6431c639175760b",
  "url": "https://osv.dev/vulnerability/CVE-2026-34066",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nimiq-blockchain: Peer-triggerable panic during history sync",
    "summary": "nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryStore::put_historic_txns` uses an `assert!` to enforce invariants about `HistoricTransaction.block_number` (must be within the macro block being pushed and within the same epoch). During history sync, a peer can influence the `history: &[HistoricTransaction]` input passed into `Blockchain::push_history_sync`, and a malformed history list can violate these invariants and trigger a panic. `extend_history_sync` calls `this.history_store.add_to_history(..)` before comparing the computed history root against the macro block header (`block.history_root()`), so the panic can happen before later rejection checks run. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.",
    "evidence": "osv:CVE-2026-34066",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-34066",
      "aliases": [
        "CVE-2026-34066",
        "GHSA-j99g-7rqw-q9jg"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/nimiq/core-rs-albatross",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "5bd15d9af710abeecdfb63d0a721dc883efb59c4"
                },
                {
                  "fixed": "6f5511309c199d84b012fe6b9aba7e5582892c50"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.3.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6f5511309c199d84b012fe6b9aba7e5582892c50"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "5bd15d9af710abeecdfb63d0a721dc883efb59c4"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.3.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v1.0.0-rc.5",
            "v1.0.0-rc.4",
            "v1.0.0-rc.3",
            "v1.0.0-rc.2",
            "v1.0.0-rc.1",
            "v1.0.0-rc.0",
            "v0.24.4",
            "v0.24.3",
            "v0.24.2",
            "v0.24.1",
            "v0.24.0",
            "v0.23.0",
            "v0.22.3",
            "v0.22.2",
            "v0.22.1",
            "v0.22.0",
            "v0.21.1",
            "v0.21.0",
            "v0.20.5",
            "v0.20.4",
            "v0.20.3",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.0",
            "v0.18.0",
            "v0.17.0",
            "v0.16.1",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.1",
            "v0.13.0",
            "v0.12.1",
            "v0.12.0",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.0",
            "v0.9.0",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.0",
            "v0.6.0",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.0",
            "v0.1.0-rc.3",
            "v0.1.0-rc.2",
            "v0.1.0-rc.1",
            "v0.1.0-rc.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34066.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:37.398322470Z",
      "provider": "osv",
      "references": [
        "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34066.json",
        "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-j99g-7rqw-q9jg",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-34066",
        "https://github.com/nimiq/core-rs-albatross/commit/6f5511309c199d84b012fe6b9aba7e5582892c50",
        "https://github.com/nimiq/core-rs-albatross/pull/3656"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-20",
          "CWE-617",
          "CWE-754"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34066.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-34066",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504642,
  "published_at": "2026-04-22T19:47:49.249+00:00"
}