{"id":"GHSA-7c4j-2m43-2mgh","revision":"b8f4f8ac620c45e58f331d173f8fccaf","records":[{"revision":"b8f4f8ac620c45e58f331d173f8fccaf","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-7c4j-2m43-2mgh","aliases":["CVE-2026-34065"],"title":"nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals","description":"### Impact\nAn untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` set contains an invalid compressed BLS voting key.\n\nHashing an election macro header hashes `validators` and reaches `Validators::voting_keys()`, which calls `validator.voting_key.uncompress().unwrap()` and panics on invalid bytes.\n\n### Patches\n[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff) is included as part of [v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0).\n\n### Workarounds\nNo known workarounds.","state":0,"publishedAt":"2026-04-22T19:19:28+00:00","modifiedAt":"2026-05-05T16:03:26.628366+00:00","affected":[{"ecosystem":"crates.io","name":"nimiq-primitives","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-7c4j-2m43-2mgh","https://nvd.nist.gov/vuln/detail/CVE-2026-34065","https://github.com/nimiq/core-rs-albatross/pull/3662","https://github.com/nimiq/core-rs-albatross/commit/e10eaebcd7774e5da6d0ff5e88ed13503474f0ff","https://github.com/nimiq/core-rs-albatross","https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0"],"sourceUrl":"https://github.com/advisories/GHSA-7c4j-2m43-2mgh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7c4j-2m43-2mgh","identifiers":["GHSA-7c4j-2m43-2mgh","CVE-2026-34065"]},"retained":false,"historicalAffected":[]}],"coverage":[]}