{"id":"GHSA-49xc-52mp-cc9j","revision":"d23257f809464afe9dd3ea3d5e8ec1a3","records":[{"revision":"d23257f809464afe9dd3ea3d5e8ec1a3","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-49xc-52mp-cc9j","aliases":["CVE-2026-40093"],"title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"### Impact\n\nBlock timestamp validation enforces that `timestamp >= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule.\n\n### Patches\nTBD\n\n### Workarounds\nNo know workarounds.","state":0,"publishedAt":"2026-04-10T19:55:04+00:00","modifiedAt":"2026-04-10T20:11:22.935964+00:00","affected":[{"ecosystem":"crates.io","name":"nimiq-blockchain","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.3.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j","https://nvd.nist.gov/vuln/detail/CVE-2026-40093","https://github.com/nimiq/core-rs-albatross"],"sourceUrl":"https://github.com/advisories/GHSA-49xc-52mp-cc9j","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-49xc-52mp-cc9j","identifiers":["GHSA-49xc-52mp-cc9j","CVE-2026-40093"]},"retained":false,"historicalAffected":[]}],"coverage":[]}