CVE-2026-33471 Details
Description
nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Prior to version 1.3.0, if an attacker can get a `SkipBlockProof` verified where `MultiSignature.signers` contains out-of-range indices spaced by 65536, these indices inflate `len()` but collide onto the same in-range `u16` slot during aggregation. This makes it possible for a malicious validator with far fewer than `2f+1` real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.
A vulnerability exists in the Nimiq Block Rust implementation, specifically in versions through 1.2.2. The issue arises in the `SkipBlockProof::verify` method, which improperly handles signer indices. The method uses a `BitSet` to determine quorum by checking the length of the set and then iterating through the indices. However, indices that are out of range can be crafted to inflate the apparent number of signers while collapsing into valid slots during aggregation. This manipulation allows a validator with significantly fewer than the required signer slots to falsely pass the quorum check by multiplying a single BLS signature. The vulnerability can be exploited if an attacker can get a `SkipBlockProof` verified with strategically placed out-of-range indices in the `MultiSignature.signers` set.
Users can upgrade to Nimiq Block version 1.3.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nimiq nimiq proof-of-stake | < 1.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |