CVE-2026-46539

{"id": "CVE-2026-46539", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46539", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:36:09.150189Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nimiq", "product": "core-rs-albatross", "versions": [{"status": "affected", "version": "< 1.4.0"}]}]}], "published": "2026-06-10T00:16:54.097", "references": [{"url": "https://github.com/nimiq/core-rs-albatross/pull/3705", "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-799f-29jm-gr6c", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as \"proven\" without any hash or signature verification. This issue has been patched in version 1.4.0."}, {"lang": "es", "value": "Nimiq es una implementaci\u00f3n en Rust del protocolo Nimiq de Prueba de Participaci\u00f3n basado en el algoritmo de consenso Albatross. Antes de la versi\u00f3n 1.4.0, una falla l\u00f3gica en BlockInclusionProof::is_block_proven hace que la funci\u00f3n devuelva verdadero sin realizar ninguna verificaci\u00f3n criptogr\u00e1fica cuando get_interlink_hops produce una lista de saltos vac\u00eda. Esto ocurre cuando el bloque objetivo est\u00e1 en la posici\u00f3n del bloque de elecci\u00f3n inmediatamente anterior a la \u00e9poca del election head. Un atacante que proporciona pruebas de inclusi\u00f3n de transacciones puede falsificar un encabezado de MacroBloque para esa posici\u00f3n de \u00e9poca y hacer que sea aceptado como 'probado' sin ninguna verificaci\u00f3n de hash o firma. Este problema ha sido parcheado en la versi\u00f3n 1.4.0."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}