GHSA-799f-29jm-gr6c

Source

https://github.com/advisories/GHSA-799f-29jm-gr6c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-799f-29jm-gr6c/GHSA-799f-29jm-gr6c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-799f-29jm-gr6c

Aliases

CVE-2026-46539

Published

2026-05-21T19:38:00Z

Modified

2026-05-21T19:46:27.101268247Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

nimiq-primitives: BlockInclusionProof interlink issue when hops are empty

Details

Impact

A logic flaw in BlockInclusionProof::is_block_proven causes the function to return true without performing any cryptographic verification when get_interlink_hops yields an empty hop list. This occurs when the target block is at the election block position immediately preceding the election head's epoch. An attacker providing transaction inclusion proofs can forge a MacroBlock header for that epoch position and have it accepted as "proven" without any hash or signature verification.

Patches

The patch for this vulnerability is formally released as part of v1.4.0.

Workarounds

No Workarounds

Resources

See PR.

Database specific

{
    "github_reviewed_at": "2026-05-21T19:38:00Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-345"
    ],
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

crates.io / nimiq-primitives

Package

Name: nimiq-primitives; View open source insights on deps.dev
Purl: pkg:cargo/nimiq-primitives

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-799f-29jm-gr6c/GHSA-799f-29jm-gr6c.json"