CVE-2026-34069: nimiq-consensus panics via RequestMacroChain micro-block locator
(updated )
An unauthenticated p2p peer can cause the RequestMacroChain message handler task to panic by sending a RequestMacroChain message where the first locator hash that is on the victim’s main chain is a micro block hash (not a macro block hash).
In RequestMacroChain::handle, the handler selects the locator based only on “is on main chain”, then calls get_macro_blocks() and panics via .unwrap() when the selected hash is not a macro block (BlockchainError::BlockIsNotMacro).
References
- github.com/advisories/GHSA-48m6-486p-9j8p
- github.com/nimiq/core-rs-albatross/commit/ae6c1e92342e72f80fd12accbe66ee80dd6802ac
- github.com/nimiq/core-rs-albatross/pull/3660
- github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0
- github.com/nimiq/core-rs-albatross/security/advisories/GHSA-48m6-486p-9j8p
- nvd.nist.gov/vuln/detail/CVE-2026-34069
Code Behaviors & Features
Detect and mitigate CVE-2026-34069 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →