CVE-2026-33471Critical· 9.6▾ Midnightnimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
SkipBlockProof::verify computes its quorum check using BitSet.len(), then iterates BitSet indices and casts each usize index to u16 (slot as u16) for slot lookup. If an attacker can get a SkipBlockProof verified where MultiSignature.signers contains out-of-range indices spaced by 65536, these indices inflate len() but collide onto the same in-range u16 slot during aggregation.
This makes it possible for a malicious validator with far fewer than 2f+1 real signer slots to pass skip block proof verification by multiplying a single BLS signature by the same factor.
The patch for this vulnerability is included as part of v1.3.0.
No known workarounds.
nimiq-block < 1.7.2Upgrade to a patched release:
nimiq-block 1.7.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105754Medium· 6.5vLLM is an inference and serving engine for large language models
CVE-2026-115906Medium· 6.5zip: AES Entry HMAC Authentication Bypass on Premature EOF
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
CVE-2026-115382Medium· 4.8Wasmtime wasi:http implementation panics with a zero timeout supplied
CVE-2026-19028Medium· 6.8H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allow…
CVE-2026-102711Medium· 5.6Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_txm_module_manager_in_place_load` — APIs that take ONLY a base pointer, no image…