7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34065

CVE-2026-34065: nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

Impact

An untrusted p2p peer can cause a node to panic by announcing an election macro block whose validators set contains an invalid compressed BLS voting key.

Hashing an election macro header hashes validators and reaches Validators::voting_keys(), which calls validator.voting_key.uncompress().unwrap() and panics on invalid bytes.

Patches

The patch for this vulnerability is included as part of v1.3.0.

Workarounds

No known workarounds.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34065

CVE-2026-34065:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nimiq-primitives	rust	<= 0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from a node crash caused by processing a block with an invalid compressed BLS voting key for a validator. The core issue lies in the unsafe use of .unwrap() or .expect() on the result of the key.uncompress() method, which returns an Option. When uncompress() fails on invalid data, it returns None, and the subsequent unwrap() call triggers a panic, leading to a denial of service.

The analysis of the patch commit e10eaebcd7774e5da6d0ff5e88ed13503474f0ff pinpointed several vulnerable functions:

Validators::voting_keys: Located in primitives/src/slots_allocation.rs, this function was the primary source of the panic, containing the validator.voting_key.uncompress().unwrap() call.
Validators::hash: The Hash implementation for Validators in the same file was also vulnerable as it called voting_keys_g2(), which in turn called the panicking voting_keys() function. This was a major attack vector, as hashing is a standard operation when receiving new blocks from peers. The BlockQueue::request_block function is a runtime indicator of this vector being triggered.
Proof Verification Functions: DoubleVoteProof::verify and TendermintProof::verify_justification also contained direct calls to uncompress().expect(), creating additional vectors for the panic if a malicious proof was provided.

The patch rectifies these issues by replacing the unsafe unwraps with proper error handling, primarily by changing functions like voting_keys to return a Result. It also introduces proactive validation by adding a Validators::validate_keys() function and calling block.verify_header() in the block processing queue to reject malformed blocks early.

Vulnerable functions

Validators::voting_keys

primitives/src/slots_allocation.rs

This function is the root cause of the vulnerability. It directly called `unwrap()` on the result of `uncompress()`, which would panic if the compressed BLS key was invalid and `uncompress()` returned `None`. This function was called by other vulnerable functions like `hash`.

Validators::hash

primitives/src/slots_allocation.rs

This function, part of the `Hash` trait implementation, was vulnerable because it called `voting_keys_g2()`, which in turn called the panicking `voting_keys()` function. Hashing a block with invalid validator data, a common operation when receiving blocks from peers, would trigger the panic.

DoubleVoteProof::verify

primitives/block/src/equivocation_proof.rs

This function used `uncompress().expect()` when verifying an equivocation proof. A malicious proof containing an invalid compressed public key would cause this function to panic, crashing the node.

TendermintProof::verify_justification

primitives/block/src/tendermint.rs

Similar to `DoubleVoteProof::verify`, this function used `uncompress().expect()` when verifying a Tendermint proof justification. A malicious justification with an invalid key would cause a panic.

BlockQueue::request_block

consensus/src/sync/live/block_queue/queue.rs

This function processes blocks received from peers. Before the patch, it would call `block.hash_cached()` without prior validation. This would trigger the panic in `Validators::hash` if the block contained invalid validator keys. This function represents a key entry point for the exploit from a p2p peer.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.