CVE-2026-34067: 
Rust vulnerability analysis and mitigation

CVE-2026-34067 is a reachable assertion (panic) vulnerability in the nimiq-transaction Rust crate used by the Nimiq proof-of-stake blockchain node (core-rs-albatross). The flaw exists in HistoryTreeProof::verify, which panics when a malformed inclusion proof is received where history.len() != positions.len() due to an unchecked assert_eq! macro. All versions of nimiq-transaction up to and including v0.2.0 (and nimiq_proof-of-stake prior to v1.3.0) are affected. The vulnerability was published on April 22, 2026, with a patch released the same day as part of v1.3.0. The CVSS v3.1 base score is 3.1 (Low) per the GitHub Advisory, though Feedly's NVD-sourced data assigns a higher score of 6.5 (Medium) (Github Advisory, Nimiq Advisory).

The root cause is classified as CWE-617 (Reachable Assertion) and CWE-20 (Improper Input Validation). In primitives/transaction/src/history_proof.rs, the HistoryTreeProof::verify function used assert_eq!(self.history.len(), self.positions.len()) to enforce a length invariant; because Rust's assert_eq! panics on failure rather than returning an error, a length mismatch causes the entire node process to crash. The proof object originates from untrusted peer-to-peer network responses (ResponseTransactionsProof.proof) and is attacker-controlled at the network boundary before any validation occurs. The fix replaces the assertion with a graceful guard (if self.history.len() != self.positions.len() { return None; }), consistent with the method's documented error-returning contract (Nimiq Commit, Nimiq PR).

Successful exploitation results in a denial-of-service condition: a malicious peer on the Nimiq p2p network can crash any vulnerable node by sending a single crafted ResponseTransactionsProof message containing a HistoryTreeProof with mismatched history and positions array lengths. There is no impact on confidentiality or integrity — the vulnerability is purely an availability issue. Repeated exploitation could prevent affected nodes from participating in the network, disrupting blockchain synchronization and transaction processing (Github Advisory, Nimiq Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.011% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify Nimiq proof-of-stake nodes running nimiq-transaction versions ≤ 0.2.0 or nimiq_proof-of-stake < 1.3.0 by connecting to the Nimiq p2p network and observing peer version announcements.
2. Establish peer connection: Connect to a target node as a legitimate-appearing peer on the Nimiq p2p network.
3. Craft malformed proof: Construct a ResponseTransactionsProof message containing a HistoryTreeProof where the history and positions arrays have deliberately mismatched lengths (e.g., history.len() = 5, positions.len() = 3).
4. Trigger the panic: Send the crafted response to the target node when it requests transaction proofs during history synchronization. The node's HistoryTreeProof::verify function will hit the assert_eq! and panic, crashing the node process.
5. Repeat for sustained DoS: Re-establish a peer connection and repeat the attack to prevent the node from staying online (Nimiq Advisory, Nimiq PR).

• Logs: Rust panic messages in node logs referencing assert_eq!(history.len(), positions.len()) in primitives/transaction/src/history_proof.rs; repeated unexpected node process exits or restarts.
• Network: Unexpected or repeated ResponseTransactionsProof messages from a single peer IP containing malformed proof structures; peers that repeatedly reconnect and trigger node crashes.
• Process: Sudden termination of the Nimiq node process (nimiq-node or equivalent) without a graceful shutdown signal, particularly during history synchronization phases.

Upgrade the nimiq-transaction crate and nimiq_proof-of-stake to version 1.3.0 or later, which replaces the panicking assert_eq! with a safe None-returning guard. No configuration-based workarounds are available. Node operators should prioritize this update, as the attack is network-accessible and requires no authentication (Nimiq Release, Nimiq Advisory).