CVE-2026-46545

The record

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes). This issue has been patched in version 1.5.0.

Affected packages

Related vulnerabilities

• GHSA-mw3q-r9wh-h2ff nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item Same vulnerability
• CVE-2026-46539 Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the… Also affects nimiq-primitives
• GHSA-799f-29jm-gr6c nimiq-primitives: BlockInclusionProof interlink issue when hops are empty Also affects nimiq-primitives
• CVE-2026-34065 nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in… Also affects nimiq-primitives
• GHSA-7c4j-2m43-2mgh nimiq-primitives: Node crash due to missing interlink validation in election macro block… Also affects nimiq-primitives
• CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-248
• CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform. CWE-248
• CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB… CWE-248