CVE-2026-54542 Details
Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
A vulnerability exists in Nimiq's Rust implementation of the Proof-of-Stake protocol, specifically in versions through 1.5.1. The issue arises during the state synchronization process, where a malicious peer can send a crafted TrieChunk that causes a syncing node to crash. This is achieved by including a TrieNodeChild suffix in the proof that, while individually valid, concatenates with the parent key to exceed the 63-byte limit of the KeyNibbles array. The KeyNibbles::Add function performs this concatenation without proper length validation, leading to an out-of-bounds panic. Exploitation requires the attacker to be selected as the victim's sync peer, but no valid cryptographic proof is needed. The node's crash is temporary, as it restarts and resynchronizes automatically.
Users are advised to upgrade to Nimiq version 1.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf | [email protected] | Source CodeVendor |
| https://github.com/nimiq/core-rs-albatross/pull/3790 | [email protected] | Source CodeVendor |
| https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0 | [email protected] | Release NotesVendor |
| https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nimiq | <= 1.5.1 (semver) |
CPE
Remediation
| |
| Nimiq core-rs-albatross | <= 1.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |