{"id":"EUVD-2026-22160","revision":"250775083fef441da25054b5407c2615","records":[{"revision":"250775083fef441da25054b5407c2615","observedAt":"2026-11-01T06:05:29.094+00:00","statement":{"source":"euvd","id":"EUVD-2026-22160","aliases":["CVE-2026-34069","GHSA-48m6-486p-9j8p"],"title":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task …","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. In versions 1.2.2 and below, an unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic. Sending a RequestMacroChain message where the first locator hash on the victim’s main chain is a micro block hash (not a macro block hash) causes said panic. The RequestMacroChain::handle handler selects the locator based only on \"is on main chain\", then calls get_macro_blocks() and panics via .unwrap() when the selected hash is not a macro block (BlockchainError::BlockIsNotMacro). This issue has been fixed in version 1.3.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-48m6-486p-9j8p","https://github.com/nimiq/core-rs-albatross/pull/3660","https://github.com/nimiq/core-rs-albatross/commit/ae6c1e92342e72f80fd12accbe66ee80dd6802ac","https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22160","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 13, 2026, 11:55:52 PM","dateUpdated":"Apr 14, 2026, 4:28:14 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-22160","identifiers":["EUVD-2026-22160","CVE-2026-34069","GHSA-48m6-486p-9j8p"]},"retained":false,"historicalAffected":[]}],"coverage":[]}