CVE-2026-33471 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
A malicious validator can bypass skip block proof verification in nimiq-block by exploiting integer truncation to inflate quorum counts with out-of-range indices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33471?
CVE-2026-33471 is a critical vulnerability in nimiq-block, published on 22 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot lookup. Prior to version 1.3.0, if an attacker can get a `SkipBlockProof` verified where `MultiSignature.signers` contains out-of-range indices spaced by 65536, these indices inflate `len()` but collide onto the same in-range `u16` slot during aggregation. This makes it possible for a malicious validator with far fewer than `2f+1` real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor. The patch for this vulnerability is included as part of v1.3.0. No known workarounds are available.
Which versions are affected by CVE-2026-33471?
2 open source packages ship an affected version, including nimiq-block. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nimiq-block crates.io | All versions to 0.2.0 | None |
nimiq-block crates.io | All versions to 0.2.0 | None |
Products include Nimiq Nimiq Proof-of-Stake.
How do I fix CVE-2026-33471?
No fix has been published for CVE-2026-33471 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33471 being exploited?
There is no known exploitation of CVE-2026-33471 in the wild and no public exploit code.
Other vulnerabilities in nimiq-block
- CVE-2026-40093 nimiq-blockchain is missing a wall-clock upper bound on block timestamps
- CVE-2026-34063 network-libp2p: Peer can crash the node by opening discovery protocol substream twice
- CVE-2026-34065 nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
- CVE-2026-32605 Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer
- CVE-2026-33184 nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic
Sources
Also known as GHSA-6973-8887-87ff.