CVE-2026-46539 (GCVE-0-2026-46539)

Vulnerability from cvelistv5 – Published: 2026-06-09 23:44 – Updated: 2026-06-10 14:36
VLAI
Title
nimiq-primitives: BlockInclusionProof interlink issue when hops are empty
Summary
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification. This issue has been patched in version 1.4.0.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
Impacted products
Vendor Product Version
nimiq core-rs-albatross Affected: < 1.4.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46539",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T14:36:09.150189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T14:36:28.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core-rs-albatross",
          "vendor": "nimiq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head\u0027s epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as \"proven\" without any hash or signature verification. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T23:44:34.283Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c"
        },
        {
          "name": "https://github.com/nimiq/core-rs-albatross/pull/3705",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nimiq/core-rs-albatross/pull/3705"
        },
        {
          "name": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-799f-29jm-gr6c",
        "discovery": "UNKNOWN"
      },
      "title": "nimiq-primitives: BlockInclusionProof interlink issue when hops are empty"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46539",
    "datePublished": "2026-06-09T23:44:34.283Z",
    "dateReserved": "2026-05-14T20:42:31.368Z",
    "dateUpdated": "2026-06-10T14:36:28.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46539",
      "date": "2026-08-04",
      "epss": "0.0015",
      "percentile": "0.04691"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46539\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-10T00:16:54.097\",\"lastModified\":\"2026-07-23T09:10:00.113\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head\u0027s epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as \\\"proven\\\" without any hash or signature verification. This issue has been patched in version 1.4.0.\"},{\"lang\":\"es\",\"value\":\"Nimiq es una implementaci\u00f3n en Rust del protocolo Nimiq de Prueba de Participaci\u00f3n basado en el algoritmo de consenso Albatross. Antes de la versi\u00f3n 1.4.0, una falla l\u00f3gica en BlockInclusionProof::is_block_proven hace que la funci\u00f3n devuelva verdadero sin realizar ninguna verificaci\u00f3n criptogr\u00e1fica cuando get_interlink_hops produce una lista de saltos vac\u00eda. Esto ocurre cuando el bloque objetivo est\u00e1 en la posici\u00f3n del bloque de elecci\u00f3n inmediatamente anterior a la \u00e9poca del election head. Un atacante que proporciona pruebas de inclusi\u00f3n de transacciones puede falsificar un encabezado de MacroBloque para esa posici\u00f3n de \u00e9poca y hacer que sea aceptado como \u0027probado\u0027 sin ninguna verificaci\u00f3n de hash o firma. Este problema ha sido parcheado en la versi\u00f3n 1.4.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"nimiq\",\"product\":\"core-rs-albatross\",\"versions\":[{\"version\":\"\u003c 1.4.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T14:36:09.150189Z\",\"id\":\"CVE-2026-46539\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"references\":[{\"url\":\"https://github.com/nimiq/core-rs-albatross/pull/3705\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-11T02:59:21+00:00",
      "cve": "CVE-2026-46539",
      "id": "CVE-2026-46539",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "nimiq-primitives: BlockInclusionProof interlink issue when hops are empty",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46539.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"nimiq-primitives: BlockInclusionProof interlink issue when hops are empty\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-345\", \"lang\": \"en\", \"description\": \"CWE-345: Insufficient Verification of Data Authenticity\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c\"}, {\"name\": \"https://github.com/nimiq/core-rs-albatross/pull/3705\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/nimiq/core-rs-albatross/pull/3705\"}, {\"name\": \"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0\"}], \"affected\": [{\"vendor\": \"nimiq\", \"product\": \"core-rs-albatross\", \"versions\": [{\"version\": \"\u003c 1.4.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-09T23:44:34.283Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head\u0027s epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as \\\"proven\\\" without any hash or signature verification. This issue has been patched in version 1.4.0.\"}], \"source\": {\"advisory\": \"GHSA-799f-29jm-gr6c\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-46539\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T14:36:09.150189Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-10T14:36:21.653Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-46539\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-05-14T20:42:31.368Z\", \"datePublished\": \"2026-06-09T23:44:34.283Z\", \"dateUpdated\": \"2026-06-10T14:36:28.257Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.