Live › vulnerability › CVE-2026-33471
The nimiq-block Rust crate's skip block proof verification counts signers using an index length but truncates indices to 16 bits, so out-of-range indices collide with real slots. A malicious validator with far fewer than the required signers can get a forged skip block proof accepted by repeating one BLS signature.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:37 UTC, 0h before NVD. All times on this page are UTC.
Teams running Nimiq node or light-client software, or other Rust code that calls SkipBlockProof::verify from the nimiq-block crate, are exposed because forged proofs would be accepted as valid. Code that does not use Nimiq's blockchain proof verification can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| nimiq-block | cargo | < 1.3.0 | 1.7.2 |
| nimiq proof-of-stake | vendor | < 1.3.0 | 1.3.0 |
nimiq-block in its Cargo.lock and note the locked version.1.7.2 (the advisory's product range also lists 1.3.0 as the first patched release in its patch notes; the affected range is recorded as below 1.3.0).nimiq-block: move to 1.7.2 (fixed version per the advisory's product range); the patch is also included in v1.3.0 per the maintainer's patch notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SkipBlockProof::verify computes its quorum check using BitSet.len(), then iterates BitSet indices and casts each usize index to u16 (slot as u16) for slot lookup. If an attacker can get a SkipBlockProof verified where MultiSignature.signers contains out-of-range indices spaced by 65536, these indices inflate len() but collide onto the same in-range u16 slot during aggregation.
This makes it possible for a malicious validator with far fewer than 2f+1 real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor.
The patch for this vulnerability is included as part of v1.3.0.
No known workarounds.
This page as .md · .json · in your agent: get_signal("CVE-2026-33471")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.