Nimiq Primitives Node Panic via Malformed BLS Key

The National Vulnerability Database has detailed CVE-2026-34065, a high-severity vulnerability (CVSS 7.5) affecting nimiq-primitives prior to version 1.3.0. This library underpins Nimiq’s Rust implementation, providing core elements like blocks and transactions. The flaw allows an untrusted peer-to-peer node to trigger a denial-of-service condition by announcing an election macro block containing an invalid compressed BLS voting key.

The vulnerability stems from how the system processes election macro headers. Specifically, hashing these headers involves validating the validators set, which subsequently calls validator.voting_key.uncompress().unwrap(). An invalid compressed BLS voting key causes this uncompression to panic, effectively crashing the node. This is a critical unauthenticated remote denial-of-service vector, as any untrusted P2P peer can exploit it.

Defenders must prioritize patching. The National Vulnerability Database confirms that the fix is included in version 1.3.0, and no workarounds are available. This means immediate upgrade is the only viable mitigation. The attacker’s calculus here is straightforward: achieve maximum disruption with minimal effort, leveraging a known cryptographic validation failure.