CVE-2026-33471 nimiq CVE debrief

Who should care

Validators, node operators, and users of the Nimiq Proof-Of-Stake implementation should assess their exposure and update to version 1.3.0 or later to prevent potential attacks. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed.

Why it matters

CVE-2026-33471 is a critical vulnerability in the Nimiq Proof-Of-Stake implementation that allows an attacker to manipulate skip block proof verification. Validators and node operators should update to version 1.3.0 or later to prevent potential attacks. The vulnerability requires verification of the implementation of `SkipBlockProof::verify` function.

• An attacker could manipulate skip block proof verification to pass with fewer than required signer slots.
• Validators and node operators may be impacted if they have not updated to version 1.3.0 or later.
• The vulnerability requires verification of the implementation of `SkipBlockProof::verify` function.

Technical summary

The `SkipBlockProof::verify` function in the Nimiq Proof-Of-Stake implementation incorrectly handles out-of-range indices in `MultiSignature.signers`. This allows an attacker to pass skip block proof verification with fewer than required signer slots by manipulating BLS signatures. The vulnerability was patched in version 1.3.0. Validators and node operators should review and verify the implementation of the `SkipBlockProof::verify` function to prevent potential attacks. The vulnerability requires verification of the implementation of `SkipBlockProof::verify` function.

Defensive priority

High priority for validators and node operators to update to version 1.3.0 or later to prevent potential attacks.

Recommended defensive actions

• Update to version 1.3.0 or later
• Review and verify the implementation of `SkipBlockProof::verify` function
• Monitor for potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was patched in version 1.3.0 of the Nimiq Proof-Of-Stake implementation. No known workarounds are available. The CVE record and NVD entry provide details on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.