CVE-2026-40093

The record

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.

Affected packages

Related vulnerabilities

• GHSA-49xc-52mp-cc9j nimiq-blockchain is missing a wall-clock upper bound on block timestamps Same vulnerability
• CVE-2026-46543 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the… Also affects nimiq-blockchain
• GHSA-vghx-352f-93jm nimiq-blockchain: Genesis batch set request Also affects nimiq-blockchain
• CVE-2026-34066 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. Also affects nimiq-blockchain
• GHSA-j99g-7rqw-q9jg nimiq-blockchain: Peer-triggerable panic during history sync Also affects nimiq-blockchain
• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284
• CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write data… CWE-1284
• CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… CWE-1284