3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34067

CVE-2026-34067: nimiq-transaction: Panic via `HistoryTreeProof` length mismatch

Impact

HistoryTreeProof::verify panics on a malformed proof where history.len() != positions.len() due to assert_eq!(history.len(), positions.len()).

The proof object is derived from untrusted p2p responses (ResponseTransactionsProof.proof) and is therefore attacker-controlled at the network boundary until validated. A malicious peer could trigger a crash by returning a crafted inclusion proof with a length mismatch.

Patches

The patch for this vulnerability is included as part of v1.3.0.

Workarounds

No known workarounds know.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34067

CVE-2026-34067:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nimiq-transaction	rust	<= 0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the HistoryTreeProof::verify function, located in primitives/transaction/src/history_proof.rs. The provided patch directly addresses this issue. The vulnerability is caused by an assertion (assert_eq!) that compares the lengths of two vectors, history and positions, within the HistoryTreeProof struct. This struct is constructed from data received from peers on the network, which is untrusted. A malicious peer could intentionally craft a HistoryTreeProof where the lengths of these vectors are not equal. When the verify function is called on this malformed proof, the assertion fails and causes the node to panic, resulting in a denial of service. The patch replaces the assertion with a conditional check that returns None if the lengths do not match, which is consistent with the function's documented error-handling behavior. This prevents the panic and mitigates the denial-of-service vulnerability.

Vulnerable functions

HistoryTreeProof::verify

primitives/transaction/src/history_proof.rs

The function `HistoryTreeProof::verify` used `assert_eq!` to check if the lengths of `self.history` and `self.positions` were equal. Since the `HistoryTreeProof` object is derived from untrusted P2P responses, a malicious peer could provide a proof with mismatched lengths, causing the `assert_eq!` to fail and trigger a panic, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.