CVE-2026-46540: Nimiq Rust Implementation DoS Vulnerability

CVE-2026-46540 Overview

CVE-2026-46540 affects Nimiq, a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The vulnerability exists in versions prior to 1.4.0, where LightBlockchain::rebranch() fails to update macro chain state when adopting a fork chain whose tip is a macro block. The flaw causes light clients to verify subsequent macro blocks against stale state, eventually stalling chain progression. The issue is classified under [CWE-841] (Improper Enforcement of Behavioral Workflow) and was patched in version 1.4.0.

Critical Impact
Light clients can be forced into a state where chain progression halts entirely, blocking validation of new macro blocks and producing a denial-of-service condition for affected nodes.

Affected Products

Nimiq core-rs-albatross versions prior to 1.4.0
Nimiq light client implementations using LightBlockchain
Nimiq Proof-of-Stake Albatross consensus deployments

Discovery Timeline

2026-06-10 - CVE-2026-46540 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-46540

Vulnerability Analysis

The vulnerability resides in the LightBlockchain::rebranch() function within the Nimiq Albatross codebase. When the light client adopts a fork chain whose tip is a macro block (either a checkpoint or election block), the rebranch routine updates only self.head. It fails to update self.macro_head, self.election_head, self.current_validators, and does not store the election header in the chain_store.

This behavior contradicts the corresponding logic in the full Blockchain::rebranch() implementation located at blockchain/src/blockchain/push.rs:504-518. The full blockchain implementation correctly synchronizes all macro and election state when the new head is a macro block. Light clients diverge from this contract and retain stale references.

Root Cause

The root cause is incomplete state synchronization during fork adoption in the light client. The rebranch function omits the macro-state update branch that the full client performs. After a rebranch to a macro block, subsequent blocks pushed via push() are validated against the wrong predecessor through verify_macro_successor(&this.macro_head).

Attack Vector

A network attacker can craft and propagate a fork chain whose tip is a macro block, then induce the light client to rebranch. If the rebranch target is an election block, the stale current_validators causes every subsequent block to fail verify_validators(). Chain progression halts completely on the affected light client, isolating it from network consensus. The attack requires no authentication and exploits behavioral inconsistencies between light and full client implementations.

The vulnerability does not permit code execution or credential disclosure but does enable a targeted denial-of-service against light client operators. See the GitHub Security Advisory GHSA-m3pg-qc2q-mg8c for technical details.

Detection Methods for CVE-2026-46540

Indicators of Compromise

Light client nodes reporting persistent verify_validators() failures across consecutive blocks
Stalled chain progression on light clients while full nodes continue to advance
Repeated verify_macro_successor mismatches in client logs following a rebranch event

Detection Strategies

Monitor light client logs for rebranch events followed by sustained block verification failures
Compare chain tip height between local light clients and reference full nodes to detect divergence
Audit deployed Nimiq binaries to identify versions older than 1.4.0

Monitoring Recommendations

Establish alerting on light client block-height stagnation lasting longer than expected macro block intervals
Track peer disconnection patterns and fork adoption events for anomalous fork propagation
Log and review all LightBlockchain::rebranch() invocations targeting macro block tips

How to Mitigate CVE-2026-46540

Immediate Actions Required

Upgrade all Nimiq light clients to version 1.4.0 or later without delay
Inventory all deployed Nimiq Albatross nodes and identify any running vulnerable versions
Restart affected light clients after patching to clear any stale in-memory state

Patch Information

The maintainers patched the vulnerability in Nimiq core-rs-albatross version 1.4.0. The fix aligns LightBlockchain::rebranch() behavior with the full blockchain implementation, ensuring macro_head, election_head, current_validators, and the election header in chain_store are updated when the rebranch tip is a macro block. Review the GitHub Pull Request 3706 and the GitHub Release v1.4.0 notes for implementation specifics.

Workarounds

Operate full nodes instead of light clients where feasible until patching completes
Restrict light client peering to trusted nodes to reduce exposure to malicious fork propagation
Implement external monitoring to automatically restart and resync stalled light clients

bash

# Upgrade Nimiq core-rs-albatross to patched version
git clone https://github.com/nimiq/core-rs-albatross.git
cd core-rs-albatross
git checkout v1.4.0
cargo build --release