How severe is CVE-2026-35468?

CVE-2026-35468 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-35468 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-35468?

CVE-2026-35468 affects Nimiq Nimiq Proof-of-stake. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-35468?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-35468 have an EU (EUVD) identifier?

Yes. CVE-2026-35468 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18929.

When was CVE-2026-35468 published?

CVE-2026-35468 was published on 2026-04-03 and last updated on 2026-06-17.

CVE-2026-35468

CVE-2026-35468 is a medium-severity vulnerability in Nimiq Nimiq Proof-of-stake with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-252.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-18929
Weakness: CWE-252
Affected product: Nimiq Nimiq Proof-of-stake
Published: 2026-04-03
Last modified: 2026-06-17

Description

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.

Frequently asked questions

What is CVE-2026-35468?: nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
How severe is CVE-2026-35468?: CVE-2026-35468 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-35468 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-35468?: CVE-2026-35468 affects Nimiq Nimiq Proof-of-stake. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-35468?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-35468 have an EU (EUVD) identifier?: Yes. CVE-2026-35468 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18929.
When was CVE-2026-35468 published?: CVE-2026-35468 was published on 2026-04-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*

More vulnerabilities in Nimiq Nimiq Proof-of-stake

CVE-2026-33471 — Critical (CVSS 9.6): nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its…
CVE-2026-40093 — High (CVSS 8.1): nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block…
CVE-2026-34065 — High (CVSS 7.5): nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation.…
CVE-2026-34063 — High (CVSS 7.5): Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `network-libp2p`…
CVE-2026-32605 — High (CVSS 7.5): nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…
CVE-2026-33184 — High (CVSS 7.5): nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

All CVEs affecting Nimiq Nimiq Proof-of-stake →

Other CWE-252 vulnerabilities

CVE-2025-66565 — Critical (CVSS 9.8): Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's…
CVE-2021-38171 — Critical (CVSS 9.8): adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a…
CVE-2021-26955 — Critical (CVSS 9.8): An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because…
CVE-1999-0199 — Critical (CVSS 9.8): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return…
CVE-2019-15900 — Critical (CVSS 9.8): An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without…
CVE-2010-0211 — Critical (CVSS 9.8): The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the…

Browse all CWE-252 vulnerabilities →