CVE-2026-32605

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c	Patch
https://github.com/nimiq/core-rs-albatross/pull/3661	Issue Tracking Patch
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0	Release Notes
https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) nimiq/core-rs-albatross es una implementación en Rust del protocolo Nimiq Proof-of-Stake basado en el algoritmo de consenso Albatross. Antes de la versión 1.3.0, un par no confiable podría colapsar un validador al publicar un mensaje de propuesta tendermint firmado donde signer == validators.num_validators(). ProposalSender::send usa > en lugar de >= para la comprobación de límites del firmante, por lo que el caso de igualdad pasa y llega a validators.get_validator_by_slot_band(signer), lo que provoca un pánico con un índice fuera de límites antes de que se ejecute cualquier verificación de firma. Este problema ha sido solucionado en la versión 1.3.0.

Information

Published : 2026-04-13 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-32605

Mitre link : CVE-2026-32605

CVE.ORG link : CVE-2026-32605

JSON object : View

Products Affected

nimiq

nimiq_proof-of-stake

CWE

CWE-125

Out-of-bounds Read

CWE-193

Off-by-one Error

{"id": "CVE-2026-32605", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32605", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T13:20:25.349665Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nimiq", "product": "core-rs-albatross", "versions": [{"status": "affected", "version": "< 1.3.0"}]}]}], "published": "2026-04-13T20:16:33.787", "references": [{"url": "https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/pull/3661", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0."}, {"lang": "es", "value": "nimiq/core-rs-albatross es una implementaci\u00f3n en Rust del protocolo Nimiq Proof-of-Stake basado en el algoritmo de consenso Albatross. Antes de la versi\u00f3n 1.3.0, un par no confiable podr\u00eda colapsar un validador al publicar un mensaje de propuesta tendermint firmado donde signer == validators.num_validators(). ProposalSender::send usa > en lugar de >= para la comprobaci\u00f3n de l\u00edmites del firmante, por lo que el caso de igualdad pasa y llega a validators.get_validator_by_slot_band(signer), lo que provoca un p\u00e1nico con un \u00edndice fuera de l\u00edmites antes de que se ejecute cualquier verificaci\u00f3n de firma. Este problema ha sido solucionado en la versi\u00f3n 1.3.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "CD0CAAD1-7626-4A4A-A6F8-9DC46FE50731", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}