{"id":"EUVD-2026-25084","enisaUuid":"0ef736fb-1b46-394a-85f7-fd39def2b7b7","description":"nimiq-transaction provides the transaction primitive to be used in Nimiq\u0027s Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() !\u003d positions.len()` due to `assert_eq!(history.len(), positions.len())`. The proof object is derived from untrusted p2p responses (`ResponseTransactionsProof.proof`) and is therefore attacker-controlled at the network boundary until validated. A malicious peer could trigger a crash by returning a crafted inclusion proof with a length mismatch. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.","datePublished":"Apr 22, 2026, 7:52:43 PM","dateUpdated":"Apr 23, 2026, 2:17:59 PM","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","references":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-264v-m8fm-76jm\nhttps://github.com/nimiq/core-rs-albatross/pull/3659\nhttps://github.com/nimiq/core-rs-albatross/commit/6ff0800e8e031363e787c827d8d033e5694e4e6a\nhttps://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0\n","aliases":"CVE-2026-34067\nGHSA-264v-m8fm-76jm\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"e0ad8c40-f824-38d6-b46d-0e1aeb805384","product":{"name":"nimiq-transaction","vendor":{"name":"nimiq"}},"product_version":"\u003c 1.3.0"}],"enisaIdVendor":[{"id":"0823c557-b32b-32d8-8046-97174fe56233","vendor":{"name":"nimiq"}}],"enisaIdVulnerability":[{"id":"5b18090e-cad4-3474-b07d-36adba052552","vulnerability":{"id":"CVE-2026-34067","description":"nimiq-transaction provides the transaction primitive to be used in Nimiq\u0027s Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() !\u003d positions.len()` due to `assert_eq!(history.len(), positions.len())`. The proof object is derived from untrusted p2p responses (`ResponseTransactionsProof.proof`) and is therefore attacker-controlled at the network boundary until validated. A malicious peer could trigger a crash by returning a crafted inclusion proof with a length mismatch. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.","datePublished":"Apr 22, 2026, 7:52:43 PM","dateUpdated":"Apr 23, 2026, 2:17:59 PM","status":"PUBLISHED","baseScore":3.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","references":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-264v-m8fm-76jm\nhttps://github.com/nimiq/core-rs-albatross/pull/3659\nhttps://github.com/nimiq/core-rs-albatross/commit/6ff0800e8e031363e787c827d8d033e5694e4e6a\nhttps://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0\n","enisa_id":"EUVD-2026-25084\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 30, 2026, 7:19:09 AM","vulnerabilityProduct":[{"id":"015c1fa1-223d-3acc-88d5-6c2699cc7ba5","product":{"name":"nimiq-transaction","vendor":{"name":"nimiq"}},"product_version":"\u003c 1.3.0"}],"vulnerabilityVendor":[{"id":"c5b83137-af10-30a2-98f0-896c6f15b95d","vendor":{"name":"nimiq"}}]}},{"id":"6e081cc4-4595-3d03-9a61-f8aa4654cc47","vulnerability":{"id":"GHSA-264v-m8fm-76jm","description":"nimiq-transaction: Panic via `HistoryTreeProof` length mismatch","datePublished":"Apr 22, 2026, 7:20:50 PM","dateUpdated":"Apr 27, 2026, 4:22:44 PM","baseScore":0.0,"references":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-264v-m8fm-76jm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34067\nhttps://github.com/nimiq/core-rs-albatross/pull/3659\nhttps://github.com/nimiq/core-rs-albatross/commit/6ff0800e8e031363e787c827d8d033e5694e4e6a\nhttps://github.com/nimiq/core-rs-albatross\nhttps://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0\n","enisa_id":"EUVD-2026-25084\n","aliases":"GHSA-264v-m8fm-76jm\nCVE-2026-34067\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}