CVE-2026-34065 nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

nimiq-primitives contains primitives e.g., block, account, transaction to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key. Hashi...

CVE-2026-34065

nimiq-primitives contains primitives e.g., block, account, transaction to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key. Hashi...

CVE-2026-34064

The CVE-2026-34064 issue affects Nimiq-account’s VestingContract in the Rust implementation. Before v1.3.0, VestingContract::can_change_balance can produce AccountError::InsufficientFunds and builds the error with balance = self.balance - min_cap; if min_cap > balance, Coin::sub underflows and...

CVE-2026-34064 nimiq-account: Vesting insufficient funds error can panic

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, VestingContract::canchangebalance returns AccountError::InsufficientFunds when newbalance balance, the node crashes while trying to return an error. The mincap balance precondition is...

CVE-2026-34064 nimiq-account: Vesting insufficient funds error can panic

nimiq-account contains account primitives to be used in Nimiq's Rust implementation. Prior to version 1.3.0, VestingContract::canchangebalance returns AccountError::InsufficientFunds when newbalance balance, the node crashes while trying to return an error. The mincap balance precondition is...

CVE-2026-34063

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, network-libp2p discovery uses a libp2p ConnectionHandler state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer...

EUVD-2026-25058

Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, network-libp2p discovery uses a libp2p ConnectionHandler state machine. the handler assumes there is at most one inbound and one outbound discovery substream per connection. if a remote peer...

nimiq-block-production (0.1.0), nimiq-client (0.1.0) +6 more potentially affected by CVE-2026-34066 via nimiq-blockchain (0.1.0)

nimiq-blockchain CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-blockchain and may be impacted: - nimiq-block-production 0.1.0 - nimiq-client 0.1.0 - nimiq-consensus 0.1.0 - nimiq-lib 0.1.0 - nimiq-mempool 0.1.0 -...

CVE-2026-34062

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...

CVE-2026-34062 Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...

CVE-2026-34062 Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...

CVE-2026-34062 Nimiq has Allocation of Resources Without Limits or Throttling in its libp2p request/response

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, MessageCodec::readrequest and readresponse call readtoend on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because Behaviour::new also sets...

CVE-2026-34062

CVE-2026-34062 affects the Nimiq libp2p integration. Before version 1.3.0, MessageCodec::read_request and read_response call read_to_end() on inbound substreams, allowing a remote peer to send only a partial frame and keep the substream open. Additionally, Behaviour::new sets with_max_concurrent_...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +14 more potentially affected by CVE-2026-34068 via nimiq-transaction (0.1.0)

nimiq-transaction CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-transaction and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

EUVD-2026-25084

nimiq-transaction: Panic via HistoryTreeProof length mismatch...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +14 more potentially affected by CVE-2026-34067 via nimiq-transaction (0.1.0)

nimiq-transaction CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-transaction and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

EUVD-2026-25062

nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals...

nimiq-account (0.1.0), nimiq-accounts (0.1.0) +15 more potentially affected by CVE-2026-34065 via nimiq-primitives (0.1.0)

nimiq-primitives CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-primitives and may be impacted: - nimiq-account 0.1.0 - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 -...

nimiq-accounts (0.1.0), nimiq-block (0.1.0) +13 more potentially affected by CVE-2026-34064 via nimiq-account (0.1.0)

nimiq-account CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-account and may be impacted: - nimiq-accounts 0.1.0 - nimiq-block 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 - nimiq-client 0.1.0 - nimiq-consens...

nimiq-accounts (0.1.0), nimiq-block-production (0.1.0) +11 more potentially affected by CVE-2026-33471 via nimiq-block (0.1.0)

nimiq-block CARGO version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nimiq-block and may be impacted: - nimiq-accounts 0.1.0 - nimiq-block-production 0.1.0 - nimiq-blockchain 0.1.0 - nimiq-client 0.1.0 - nimiq-consensus 0.1.0 - nimiq-databas...