What is the CVSS score of CVE-2026-34061?

CVE-2026-34061 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Core Rs Albatross CVE-2026-34061

MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-04-03 GitHub_M

Information Disclosure Canonical Core Rs Albatross Nimiq

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 22:23 NVD

4.9 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Apr 03, 2026 - 23:15 vuln.today

CVE Published

Apr 03, 2026 - 22:07 nvd

MEDIUM 4.9

DescriptionNVD

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an elected validator proposer can send an election macro block whose header.interlink does not match the canonical next interlink. Honest validators accept that proposal in verify_macro_block_proposal() because the proposal path validates header shape, successor relation, proposer, body root, and state, but never checks the interlink binding for election blocks. The same finalized block is later rejected by verify_block() during push with InvalidInterlink. Because validators prevote and precommit the malformed header hash itself, the failure happens after Tendermint decides the block, not before voting. This issue has been patched in version 1.3.0.

AnalysisAI

Elected validator proposers in nimiq/core-rs-albatross before version 1.3.0 can submit election macro blocks with malformed interlink headers that bypass proposal validation but are rejected during block finalization, causing denial of service by halting consensus after Tendermint voting completes. The vulnerability requires high privileges (validator proposer role) and results in network availability impact but no data compromise, affecting the Nimiq Proof-of-Stake network's consensus reliability.

Technical ContextAI

The Nimiq core-rs-albatross is a Rust implementation of the Albatross consensus algorithm, which operates within the Tendermint Byzantine Fault Tolerant (BFT) consensus framework. The vulnerability exists in the election macro block validation logic: the verify_macro_block_proposal() function validates the block header's structural integrity, successor relationships, proposer authorization, body root, and state transitions, but critically omits validation of the header.interlink field binding for election blocks. The interlink serves as a historical chain of block references used for Proof-of-Work-style skip-list validation and consensus finality. When a malformed interlink passes proposal validation, validators sign and prevote/precommit the block hash in Tendermint. Only after consensus decides the block does verify_block() during push reject it with InvalidInterlink, creating a window where consensus has committed to a block that cannot be applied. This represents a logic error (CWE-345: Insufficient Verification of Data Authenticity) in cryptographic validation sequencing.

RemediationAI

Vendor-released patch: upgrade nimiq/core-rs-albatross to version 1.3.0 or later. The fix is implemented in commit 9d7d17c9163384e79f61cdbbfe9853ae57bb8bf7 (accessible via pull request https://github.com/nimiq/core-rs-albatross/pull/3668) and is officially released at https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0. Validators and node operators should prioritize upgrading to 1.3.0 immediately to restore interlink validation in proposal verification. No workarounds are documented; the patch is required to restore correct consensus behavior. Consult the GitHub security advisory at https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gr83-j5f8-p2r5 for operational guidance during upgrade.