{"id":"CVE-2026-40093","aliases":["EUVD-2026-21146","GHSA-49xc-52mp-cc9j"],"status":"published","title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp \u003e= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00326,"percentile":0.25954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1284","CWE-20"],"published":"2026-04-09T20:29:46Z","modified":"2026-10-28T02:30:23Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"nimiq-blockchain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"nimiq-blockchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.3.0"}]}]}],"products":[{"vendor":"nimiq","product":"core-rs-albatross"},{"vendor":"nimiq","product":"nimiq_proof-of-stake"}],"references":[{"url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j","tags":["x_refsource_CONFIRM","Broken Link","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40093","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-49xc-52mp-cc9j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40093.json","tags":["advisory"]},{"url":"https://github.com/nimiq/core-rs-albatross","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40093","title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp \u003e= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.","status":"published","published":"2026-04-09T20:29:46.026Z","modified":"2026-04-13T15:38:14.634Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-21146","description":"nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp \u003e= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.","status":"published","published":"2026-04-09T20:29:46Z","modified":"2026-04-13T15:38:14Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:27.958964Z"}],"ghsa":[{"id":"GHSA-49xc-52mp-cc9j","title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"### Impact\n\nBlock timestamp validation enforces that `timestamp \u003e= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule.\n\n### Patches\nTBD\n\n### Workarounds\nNo know workarounds.","status":"published","published":"2026-04-10T19:55:04Z","modified":"2026-04-14T10:39:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-1284"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"nvd":[{"id":"CVE-2026-40093","description":"nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp \u003e= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.","status":"published","published":"2026-04-09T21:16:11.937Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-40093","title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp \u003e= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.","status":"published","published":"2026-04-09T20:29:46.026Z","modified":"2026-10-28T02:30:23.951830979Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"GHSA-49xc-52mp-cc9j","title":"nimiq-blockchain is missing a wall-clock upper bound on block timestamps","description":"### Impact\n\nBlock timestamp validation enforces that `timestamp \u003e= parent.timestamp` for non-skip blocks and `timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT` for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via `Policy::supply_at()` and `batch_delay()` in `blockchain/src/reward.rs`, inflating the monetary supply beyond the intended emission schedule.\n\n### Patches\nTBD\n\n### Workarounds\nNo know workarounds.","status":"published","published":"2026-04-10T19:55:04Z","modified":"2026-04-10T20:11:22.935964Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-1284","CWE-20"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}