nimiq-primitives CVE-2026-46539
MEDIUM
GHSA-799f-29jm-gr6c
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 17 cargo packages depend on nimiq-primitives (11 direct, 6 indirect)
Ecosystem-wide dependent count for version 0.2.0.
DescriptionNVD
Impact
A logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification.
Patches
The patch for this vulnerability is formally released as part of v1.4.0.
Workarounds
No Workarounds
Resources
See PR.
AnalysisAI
Cryptographic verification bypass in the nimiq-primitives Rust crate allows remote unauthenticated attackers to forge MacroBlock headers and have them accepted as proven without any hash or signature check. The flaw exists in BlockInclusionProof::is_block_proven within core-rs-albatross <= 0.2.0 of nimiq-primitives: when the interlink hop list is empty - a condition that arises legitimately at a specific epoch boundary - the function previously returned true unconditionally rather than verifying the election head actually references the target block. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today