CVE-2026-35468: medium-severity vulnerability in nimiq core-rs-albatross
nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
nimiq · core-rs-albatrossRelated CVEs — nimiq core-rs-albatross
In the same product, most dangerous first.
CVE-2025-47270HIGHnimiq-network-libp2p Uncontrolled Resource Consumption vulnerabilityEPSS 0.7%CVE-2026-40092HIGHnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTEPSS 0.6%CVE-2026-46369HIGHNimiq: Validity store off by one errorEPSS 0.5%CVE-2026-33184HIGHnimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panicEPSS 0.5%CVE-2026-32605HIGHNimiq: Remote crash via off-by-one signer bounds check in proposal bufferEPSS 0.5%CVE-2026-54541LOWNimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keysEPSS 0.4%