CVE-2026-40093Disclosure(nimiq / nimiq_proof-of-stake)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_TIMEOUT for skip blocks, but there is no visible upper bound check against the wall clock. A malicious block-producing validator can set block timestamps arbitrarily far in the future. This directly affects reward calculations via Policy::supply_at() and batch_delay() in blockchain/src/reward.rs, inflating the monetary supply beyond the intended emission schedule.

nimiq CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-49xc-52mp-cc9j

Weakness type (CWE)

CWE-1284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

nimiq_proof-of-stake

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
Peaked 2d ago at 2 mentions (2026-04-09); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

nimiq

Products

nimiq_proof-of-stake

Deep dive

Activity timeline4 mentions / 3d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	2	Disclosure2
2026-04-11	1	Disclosure1
2026-04-19	1	Disclosure1

Full discourse4 posts

Giuseppe Paternicola@giuseppe_1337174d
Disclosure
🚨 HIGH: CVE-2026-40093 (CVSS 8.1) - Nimiq blockchain timestamp validation flaw allows malicious validators to manipulate block timestamps, inflating monetary supply beyond emission schedule. Affects v1.3.0 and earlier. #CVE #PatchNow #ThreatIntel https://t.co/jgUxPUPX16
Post summary
The tweet announces a high‑severity vulnerability (CVE‑2026‑40093) in Nimiq that allows timestamp manipulation and supply inflation, with no PoC, exploit, or active exploitation reported.
0000097
26 followersView on X
DailyCVE@dailycve181d
Disclosure
🔴 Nimiq #Blockchain, Missing Wall‑Clock Upper Bound, #CVE‑2026‑40093 (Critical) https://dailycve.com/nimiq-blockchain-missing-wall-clock-upper-bound-cve-2026-40093-critical/
Post summary
The tweet alerts readers to a critical CVE (CVE‑2026‑40093) affecting the Nimiq blockchain, highlighting a missing wall‑clock upper bound, but it provides no PoC, exploit details, or remediation information.
0000062
181 followersView on X
Infoflowcloud@infoflowcloud183d
Disclosure
🚨*CVE* CVE-2026-40093 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent… https://www.cve.org/CVERecord?id=CVE-2026-40093 ----- Traducción: CVE-2026-40093 nim… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑40093, a vulnerability in Nimiq's Rust-based blockchain where block timestamp validation incorrectly enforces timestamps, and links to the official CVE record.
0000055
67 followersView on X
CVE@CVEnew183d
Disclosure
CVE-2026-40093 nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent… https://www.cve.org/CVERecord?id=CVE-2026-40093
Post summary
The text announces CVE‑2026‑40093, notes a technical detail about timestamp validation, but provides no PoC, exploit code, active exploitation, or mitigation information.
00000151
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nimiq	nimiq_proof-of-stake	-	rust	-

Explore more

Back to dashboard nimiq CVEs nimiq_proof-of-stake vulnerabilities

What researchers are saying

CVE-2026-40093

Giuseppe Paternicola[verified]@giuseppe_1337Disclosure

The tweet announces a high‑severity vulnerability (CVE‑2026‑40093) in Nimiq that allows timestamp manipulation and supply inflation, with no PoC, exploit, or active exploitation reported.

DailyCVE@dailycveDisclosure

The tweet alerts readers to a critical CVE (CVE‑2026‑40093) affecting the Nimiq blockchain, highlighting a missing wall‑clock upper bound, but it provides no PoC, exploit details, or remediation information.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑40093, a vulnerability in Nimiq's Rust-based blockchain where block timestamp validation incorrectly enforces timestamps, and links to the official CVE record.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑40093, notes a technical detail about timestamp validation, but provides no PoC, exploit code, active exploitation, or mitigation information.