Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nimiq-blockchain | rust | < 1.5.0 | 1.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service caused by a reachable panic. A remote attacker can craft a RequestBatchSet message with the hash of the genesis block. This message is processed by nimiq_consensus::messages::handlers::RequestBatchSet::handle, which in turn calls nimiq_blockchain::chain_store::ChainStore::get_epoch_chunks. The get_epoch_chunks function iterates backwards from the given block. When starting from the genesis block, it attempts to find the preceding macro block by calling Policy::macro_block_before on the genesis block's number. This call is invalid and panics with the message "No macro blocks before genesis block", crashing the node. The patch introduces a check in get_epoch_chunks to prevent this call when the genesis block is reached. Therefore, both the message handler that receives the input and the function containing the panic-inducing logic are considered vulnerable.
nimiq_blockchain::chain_store::ChainStore::get_epoch_chunksblockchain/src/chain_store.rs
nimiq_consensus::messages::handlers::RequestBatchSet::handleconsensus/src/messages/handlers.rs