Loading story…
Two high-severity vulnerabilities were disclosed in Nimiq's Rust implementation affecting blockchain validation and consensus logic. CVE-2026-40093 impacts nimiq-blockchain version 1.3.0 and earlier because block timestamp validation checks only consistency with the parent block and does not enforce an upper bound against wall-clock time. A malicious block-producing validator can submit blocks dated far into the future, which alters reward calculations in Policy::supply_at() and batch_delay() and can inflate monetary supply beyond the intended emission schedule. The issue was mapped to CWE-1284 and published alongside GitHub advisory GHSA-49xc-52mp-cc9j.
A second flaw, CVE-2026-33471, affects nimiq-block versions prior to 1.3.0 in SkipBlockProof::verify, where quorum validation can be bypassed through out-of-range BitSet indices and u16 truncation. By spacing forged signer indices by 65536, a malicious validator can make multiple entries collide into the same valid slot and effectively reuse a single BLS signature to satisfy skip block proof checks without the required 2f+1 real signer slots. The vulnerability carries no known workaround, and the fix was released in version 1.3.0, highlighting risks to both consensus integrity and chain availability if unpatched nodes remain in use.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry disclosed a high-severity flaw in nimiq-block where SkipBlockProof::verify could be abused to bypass quorum validation by colliding out-of-range signer indices into valid u16 slots. The vulnerability allowed a malicious validator to satisfy verification with fewer than the required 2f+1 real signer slots.
Nimiq released version 1.3.0 to fix a flaw in nimiq-block's SkipBlockProof::verify that allowed out-of-range BitSet indices and u16 truncation to bypass the required skip block quorum. The issue affected versions prior to 1.3.0, and no workaround was noted.
A CVE entry for nimiq-blockchain was published describing a timestamp-validation flaw that let a malicious validator create blocks far in the future, impacting reward calculations and inflating supply beyond the intended emission schedule. GitHub also published the related advisory GHSA-49xc-52mp-cc9j the same day.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several high-severity flaws were disclosed in **Zebra**, the Rust-based Zcash node implementation, including bugs that can split consensus and remotely crash nodes. `CVE-2026-34377` describes a transaction verification cache logic error that could let a malicious miner reuse a valid transaction ID with invalid authorization data, causing vulnerable Zebra nodes to accept an invalid block and diverge from the main Zcash chain. A related advisory said improper sighash hash-type handling could leave isolated Zebra nodes tracking a fraudulent ledger state, creating downstream risk for exchanges, merchants, infrastructure providers, and block explorers that rely on those nodes. Additional Zebra issues can terminate nodes through denial-of-service conditions. `CVE-2026-34202` allows a remote unauthenticated attacker to send a crafted V5 transaction that passes deserialization but panics during transaction ID calculation, while another flaw in Orchard signature verification can trigger a fatal panic when an identity point is used as a randomized validating key. A separate `zebra-rpc` bug can also crash the daemon through interrupted JSON-RPC requests, though exploitation is more limited because authentication is required and the interface binds to localhost by default. The affected issues were patched in **zebrad 4.3.0**, with related fixes in **zebra-consensus 5.0.1** and **zebra-chain 6.0.1**.
Jun 29, 2026
Two high-severity flaws in the Rust implementation of **libp2p** allow remote peers to crash applications using the **Gossipsub** protocol by sending crafted `PRUNE` control messages with extremely large backoff values. **CVE-2026-33040** affects versions prior to `0.49.3`, where unchecked time arithmetic in the networking state machine can panic and cause a denial of service, while **CVE-2026-34219** affects versions prior to `0.49.4` through improper backoff expiry handling that triggers an `Instant + Duration` integer overflow during heartbeat processing. The bugs are reachable over normal Gossipsub peer connectivity, including TCP sessions using Noise with `mplex` or `yamux`, and do not require traditional authentication beyond establishing a protocol peer relationship. Both issues are classified under **CWE-190** for integer overflow, with the newer advisory also citing **CWE-617**, and both primarily impact availability by enabling unauthenticated or minimally authenticated remote attackers to force panics in exposed services. Maintainers patched the issues in **libp2p-rust** versions `0.49.3` and `0.49.4`, respectively.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **rust-openssl**, the Rust bindings for OpenSSL, affecting multiple `0.9.x` and `0.10.x` releases prior to **`0.10.78`**. **`CVE-2026-41898`** affects versions from `0.9.24` up to, but not including, `0.10.78`, where several FFI trampoline callback paths passed a closure-returned `usize` to OpenSSL without validating it against the output buffer size. The flaw can trigger buffer overflows and leak adjacent memory to a network peer, and it is mapped to **`CWE-126`** and **`CWE-130`**. A second issue, **`CVE-2026-41681`**, affects versions from `0.10.39` up to, but not including, `0.10.78`, in `MdCtxRef::digest_final()`, which writes `EVP_MD_CTX_size(ctx)` bytes to the caller buffer without checking whether the buffer is large enough. The resulting out-of-bounds write can cause stack corruption and is reachable from safe Rust, with the weakness classified as **`CWE-121`**. Both vulnerabilities were addressed in **`rust-openssl 0.10.78`**, with public advisories, code references, and fix details released alongside the CVE records.
Jun 29, 2026