https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-07T04:08:11.336845+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-46543 fkie_cve-2026-46543 2026-10-07T04:08:12.039989+00:00

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks using Policy::macro_block_before. When it reaches the genesis block number, macro_block_before panics with "No macro blocks before genesis block". This issue has been patched in version 1.5.0.

 https://vulnerability.circl.lu/vuln/ghsa-vghx-352f-93jm GHSA-vghx-352f-93jm — nimiq-blockchain: Genesis batch set request 2026-10-07T04:08:12.040098+00:00

Affected: crates.io: nimiq-blockchain

### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block".

### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0).

### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation.

### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).