CVE-2026-40093 nimiq-blockchain is missing a wall-clock upper bound on block timestamps
A malicious validator can set future block timestamps to inflate monetary supply, affecting reward calculations in the Nimiq blockchain library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40093?
CVE-2026-40093 is a high-severity vulnerability in nimiq core-rs-albatross, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.
Weakness: CWE-1284
Which versions are affected by CVE-2026-40093?
2 open source packages ship an affected version, including nimiq-blockchain. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nimiq-blockchain crates.io | All versions to 1.3.0 | None |
nimiq-blockchain crates.io | All versions to 1.3.0 | None |
Products include Nimiq Nimiq Proof-of-Stake.
How do I fix CVE-2026-40093?
No fix has been published for CVE-2026-40093 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40093 being exploited?
There is no known exploitation of CVE-2026-40093 in the wild and no public exploit code.
Other vulnerabilities in nimiq core-rs-albatross
- CVE-2026-33471 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
- CVE-2026-34063 network-libp2p: Peer can crash the node by opening discovery protocol substream twice
- CVE-2026-34065 nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals
- CVE-2026-32605 Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer
- CVE-2026-33184 nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic
Sources
Also known as GHSA-49xc-52mp-cc9j.