Threats affecting pkg:cargo/nimiq/nimiq-transaction

CVE-2026-34067 is a low-severity vulnerability in the nimiq-transaction Rust library used by Nimiq. Before version 1.3.0, the function HistoryTreeProof::verify contains an assertion that panics if a malformed proof has mismatched lengths between history and positions arrays. Since the proof data is attacker-controlled from untrusted peer-to-peer network responses, a malicious actor could cause the application to crash by sending a crafted proof with length mismatch. The issue is fixed in version 1.3.0. No workarounds are known.