CVE-2026-35468 nimiq CVE debrief

Who should care

Users of the Nimiq Proof-of-Stake protocol, specifically those using versions prior to 1.3.0, should be aware of this vulnerability and take defensive actions to mitigate potential risks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and validate the affected scope and severity with the vendor.

Technical summary

The vulnerability exists in two peer-facing consensus request handlers that assume the history index is always available. When a full node is syncing or running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress, triggering an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The affected product is the Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm, specifically versions prior to 1.3.0.

Defensive priority

Medium priority due to the potential for remote panic, but requires specific conditions to be exploited.

Recommended defensive actions

• Update to version 1.3.0 or later
• Implement compensating controls to monitor and limit requests from remote peers
• Perform inventory checks to identify affected systems
• Monitor for potential panic or crash events
• Consider applying additional security measures to limit exposure
• Review and validate the affected scope and severity with the vendor
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-03T23:17:06.963Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. There is limited information available about the specific vulnerability, and defenders should verify the affected scope and severity with the vendor. The vulnerability exists in the Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The Nimiq core-rs-albatross library is used in various products, but specific details about the affected products are not provided. The CVE record does not provide information on known or unknown affected scope.

Official resources