CVE-2026-34065

OVERVIEW CVE-2026-34065 is a denial-of-service vulnerability in nimiq-primitives versions prior to 1.3.0, a critical library used in Nimiq's Rust blockchain implementation. The flaw allows untrusted peer-to-peer network participants to trigger an unhandled panic in affected nodes by announcing election macro blocks containing invalid compressed BLS voting keys. The vulnerability exists in the validation logic where the system attempts to uncompress voting keys without proper error handling, causing immediate node termination. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack has broad scope with availability as the sole impact—an attacker can remotely crash any node running vulnerable versions without requiring special privileges or user interaction. While confidentiality and integrity are not compromised, the availability impact is severe as nodes become temporarily inaccessible. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with CISA's Known Exploited Vulnerabilities catalog showing no public exploitation activity. The vulnerability is not listed on the Hot List, and exploit code does not appear to be publicly available. However, the relatively low barrier to entry—requiring only network access to announce a malformed block—means exploitation is technically straightforward once the vulnerability details are understood. Organizations should prioritize upgrading to version 1.3.0 or later before this transitions to active exploitation.