CVE-2026-40093 Details
Description
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
A vulnerability exists in the Nimiq blockchain library for Rust, specifically in versions through 1.3.0. The issue arises from the block timestamp validation, which lacks an upper bound check against the wall clock. While the validation ensures that non-skip blocks have timestamps greater than or equal to the parent's timestamp, and that skip blocks' timestamps equal the parent's timestamp plus a specified timeout, it fails to restrict timestamps from being set arbitrarily far into the future. This flaw can be exploited by a malicious block-producing validator, leading to inflated reward calculations that disrupt the intended monetary supply schedule.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nimiq nimiq proof-of-stake | < 1.3.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |