### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block". ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0). ### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation. ### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).
Update nimiq-blockchain to 1.5.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scannimiq-blockchain: Genesis batch set request affects nimiq-blockchain (rust). Severity is medium. ### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block". ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0). ### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation. ### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).
AI coding agents often install or upgrade packages automatically in rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block". ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0). ### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation. ### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).
Update nimiq-blockchain to 1.5.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scannimiq-blockchain: Genesis batch set request affects nimiq-blockchain (rust). Severity is medium. ### Impact A remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls `get_epoch_chunks` which iterates backwards through macro blocks using `Policy::macro_block_before`. When it reaches the genesis block number, `macro_block_before` panics with "No macro blocks before genesis block". ### Patches [The patch for this vulnerability](https://github.com/nimiq/core-rs-albatross/pull/3745) is formally released as part of [v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0). ### Workarounds No Workaround, although requesting the genesis batch set is not used during normal operation. ### Resources See [PR](https://github.com/nimiq/core-rs-albatross/pull/3745).
AI coding agents often install or upgrade packages automatically in rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| nimiq-blockchainrust |
|---|
| <1.5.0 |
| 1.5.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| nimiq-blockchainrust |
|---|
| <1.5.0 |
| 1.5.0 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard