CVE-2026-46540— Nimiq light-blockchain: Light blockchain rebranch issue
Quick assessment
Affected
nimiq core-rs-albatross
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nimiq是Nimiq开源的一个Albatross协议的Rust实现。 Nimiq 1.4.0之前版本存在安全漏洞，该漏洞源于LightBlockchain::rebranch()在采用分叉链时仅更新self.head但未更新self.macro_head、self.election_head、self.current_validators或存储选举头，导致后续宏块验证错误。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nimiq | core-rs-albatross | < 1.4.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-46540
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nimiq light-blockchain: Light blockchain rebranch issue
Source: CVE Program / CVE List V5
Vulnerability Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, when LightBlockchain::rebranch() adopts a fork chain whose tip is a macro block (checkpoint or election), it only updates self.head but fails to update self.macro_head, self.election_head, self.current_validators, or store the election header in the chain_store. This is in direct contrast with the full Blockchain::rebranch() at blockchain/src/blockchain/push.rs:504-518, which correctly updates all macro/election state when the new head is a macro block. After a rebranch to a macro block, the stale macro_head causes subsequent macro blocks pushed via push() to be verified against the wrong predecessor via verify_macro_successor(&this.macro_head). If the rebranch target was an election block, the stale current_validators causes every subsequent block to fail verify_validators(), completely stalling the light client's chain progression. This issue has been patched in version 1.4.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
行为工作流的不恰当实施
Source: CVE Program / CVE List V5
Vulnerability Title
Nimiq 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nimiq是Nimiq开源的一个Albatross协议的Rust实现。 Nimiq 1.4.0之前版本存在安全漏洞，该漏洞源于LightBlockchain::rebranch()在采用分叉链时仅更新self.head但未更新self.macro_head、self.election_head、self.current_validators或存储选举头，导致后续宏块验证错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nimiq | core-rs-albatross | < 1.4.0 | - |
|
II. Public POCs for CVE-2026-46540
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46540
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-46540 (1)
Vendor Advisories for CVE-2026-46540 (1)
-
🔗 Light blockchain rebranch issue · Advisory · nimiq/core-rs-albatross · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-46540 (1)
Same Patch Batch · nimiq · 2026-06-09 · 7 CVEs total
| CVE-2026-46545 | 7.5 HIGH | nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item |
| CVE-2026-46541 | 7.5 HIGH | Nimiq network-libp2p: DHT query poisoning via first-record verification failure |
| CVE-2026-46539 | 5.9 MEDIUM | nimiq-primitives: BlockInclusionProof interlink issue when hops are empty |
| CVE-2026-46543 | 5.3 MEDIUM | nimiq-blockchain: Genesis batch set request |
| CVE-2026-44505 | 5.3 MEDIUM | Nimiq network-libp2p: Untrusted peer can wedge DHT |
| CVE-2026-46542 | 4.3 MEDIUM | nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points |
IV. Related Vulnerabilities
Same product: core-rs-albatross
-
CVE-2026-54541
Nimiq: Panic in TrieProof::verify via child_index unwrap on -
CVE-2026-54542
Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized -
CVE-2026-46369
Nimiq: Validity store off by one error -
CVE-2026-46545
nimiq-primitives: Panic DoS in trie chunk processing via ROO -
CVE-2026-46543
nimiq-blockchain: Genesis batch set request
Same vendor: nimiq
-
CVE-2026-54541
Nimiq: Panic in TrieProof::verify via child_index unwrap on -
CVE-2026-54542
Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized -
CVE-2026-46369
Nimiq: Validity store off by one error -
CVE-2026-46545
nimiq-primitives: Panic DoS in trie chunk processing via ROO -
CVE-2026-46543
nimiq-blockchain: Genesis batch set request
Same weakness: CWE-841
-
CVE-2026-70079
Windows DNS Denial of Service Vulnerability -
CVE-2026-108789
deepseek-ai deepseek-harness dsh-workflow-worker-thread agen -
CVE-2026-19878
Security vulnerabilities have been found in IBM Verify Ident -
CVE-2026-104626
Gitea fork workflow job revival through later approval -
CVE-2026-95385
Chrome 154前Windows平台集成访问限制绕过
V. Comments for CVE-2026-46540
No comments yet