An unauthenticated peer on the Nimiq network can send a specially crafted RequestMacroChain message that contains a micro block hash as the first locator. The message handler incorrectly assumes the locator is a macro block hash, calls get_macro_blocks(), and panics through an unwrap when the hash is not a macro block. This results in the node crashing, causing a denial of service for that peer and potentially disrupting network consensus.

The vulnerability affects the Rust implementation of the Nimiq Proof‑of‑Stake protocol, core‑rs‑albatross. Versions 1.2.2 and earlier are impacted. The issue was fixed in release 1.3.0.

With a CVSS score of 5.3 the vulnerability is considered medium severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs to establish a peer‑to‑peer connection to the target node and send the malformed RequestMacroChain request; no authentication or privileged access is required. Because the exploit relies on a single malicious peer message, the probability of widespread exploitation is moderate but the impact on an affected node is significant.