https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:08:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-46543 <p>Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block&#39;s hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks using Policy::macro_block_before. When it reaches the genesis block number, macro_block_before panics with &#34;No macro blocks before genesis block&#34;. This issue has been patched in version 1.5.0.</p> <p>Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block&#39;s hash. The handler calls get_epoch_chunks which iterates backwards through macro blocks using Policy::macro_block_before. When it reaches the genesis block number, macro_block_before panics with &#34;No macro blocks before genesis block&#34;. This issue has been patched in version 1.5.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-46543 https://vulnerability.circl.lu/vuln/ghsa-vghx-352f-93jm <p><strong>Affected:</strong> crates.io: nimiq-blockchain</p> <p>### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block&#39;s hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with &#34;No macro blocks before genesis block&#34;.</p> <p>### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0).</p> <p>### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation.</p> <p>### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).</p> <p><strong>Affected:</strong> crates.io: nimiq-blockchain</p> <p>### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block&#39;s hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with &#34;No macro blocks before genesis block&#34;.</p> <p>### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0).</p> <p>### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation.</p> <p>### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).</p> https://vulnerability.circl.lu/vuln/ghsa-vghx-352f-93jm