CVE-2026-46540

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.4.0

Description An issue exists in the Rust implementation of the Nimiq Proof-of-Stake protocol. When the LightBlockchain::rebranch() function adopts a fork chain with a macro block tip (such as a checkpoint or election), it updates self.head but fails to update self.macro head, self.election head, self.current validators, or the election header in the chain store. This results in a stale macro head, causing subsequent macro blocks processed via push() to be verified against an incorrect predecessor through the verify macro successor() function. Additionally, if the rebranch target is an election block, the stale current validators causes all following blocks to fail the verify validators() function, leading to a complete stall of the light client's chain progression.

Recommendations Update to version 1.4.0.