Is CVE-2026-35468 actively exploited?

CVE-2026-35468 has no public evidence of in-the-wild exploitation as of 2026-04-09.

What is the CVSS score for CVE-2026-35468?

CVE-2026-35468 has a CVSS score of 5.3 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

How do I patch CVE-2026-35468?

Patch guidance is available from nimiq security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-35468.

Which products are affected by CVE-2026-35468?

1 product: nimiq core-rs-albatross.

CVE-2026-35468 - remediation guidance & executive summary

Description

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Weaknesses: CWE-252

Metadata

Primary Vendor: NIMIQ
Published: 4/3/2026
Last Modified: 4/9/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

nimiq : core-rs-albatross

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-35468. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-35468

View on NIST NVD

CVE-2026-35468 vulnerability