{"id":"GHSA-vc34-39q2-m6q3","revision":"84b79003c09842deb3f013ba2ae23f7c","records":[{"revision":"84b79003c09842deb3f013ba2ae23f7c","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-vc34-39q2-m6q3","aliases":["CVE-2026-34064"],"title":"nimiq-account: Vesting insufficient funds error can panic","description":"### Impact\n`VestingContract::can_change_balance` returns `AccountError::InsufficientFunds` when `new_balance < min_cap`, but it constructs the error using `balance: self.balance - min_cap`. `Coin::sub` panics on underflow, so if an attacker can reach a state where `min_cap > balance`, the node crashes while trying to return an error.\n\nThe `min_cap > balance` precondition is attacker-reachable because the vesting contract creation data (32-byte format) allows encoding `total_amount` without validating `total_amount <= transaction.value` (the real contract balance). After creating such a vesting contract, the attacker can broadcast an outgoing transaction to trigger the panic during mempool admission and block processing.\n\n### Patches\n[The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/commit/4d01946f0b3d6c6e31786f91cdfb3eb902908da0) is included as part of [v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0).\n\n### Workarounds\nNo known workarounds.","state":0,"publishedAt":"2026-04-22T19:18:55+00:00","modifiedAt":"2026-05-05T16:11:14.359484+00:00","affected":[{"ecosystem":"crates.io","name":"nimiq-account","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-vc34-39q2-m6q3","https://nvd.nist.gov/vuln/detail/CVE-2026-34064","https://github.com/nimiq/core-rs-albatross/pull/3658","https://github.com/nimiq/core-rs-albatross/commit/4d01946f0b3d6c6e31786f91cdfb3eb902908da0","https://github.com/nimiq/core-rs-albatross","https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0"],"sourceUrl":"https://github.com/advisories/GHSA-vc34-39q2-m6q3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vc34-39q2-m6q3","identifiers":["GHSA-vc34-39q2-m6q3","CVE-2026-34064"]},"retained":false,"historicalAffected":[]}],"coverage":[]}