Vulnerability GHSA-6973-8887-87ff
Critical
CRITICAL RISK
CVSS Score: 9.6
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
6 months ago
April 22, 2026 at 07:13 PM UTC
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
0.0.0 - 0.2.0
0.0.0 - 0.2.0
Summary
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
Details
Impact
SkipBlockProof::verify computes its quorum check using BitSet.len(), then iterates BitSet indices and casts each usize index to u16 (slot as u16) for slot lookup. If an attacker can get a SkipBlockProof verified where MultiSignature.signers contains out-of-range indices spaced by 65536, these indices inflate len() but collide onto the same in-range u16 slot during aggregation.
This makes it possible for a malicious validator with far fewer than 2f+1 real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor.
Patches
The patch for this vulnerability is included as part of v1.3.0.
Workarounds
No known workarounds.
Impacted packages
Timeline
Published
6 months ago
April 22, 2026 at 07:13 PM UTC
Fixed (1.7.2)
7 days ago
October 23, 2026 at 04:02 AM UTC
Last Modified
12 hours ago
October 30, 2026 at 03:45 PM UTC