Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54542— Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

Quick assessment

Affected
nimiq core-rs-albatross
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nimiq 是 Nimiq 权益证明（Proof-of-Stake）协议的 Rust 语言实现，其基于 Albatross 共识算法。 在 1.6.0 版本之前，恶意的状态同步（state-sync）对等节点可以通过发送一个精心构造的 使正在同步的节点崩溃。该 中的证明包含一个 后缀，该后缀单独来看是有效的，但当与父键组合时，其总长度超过了 后备数组的 63 字节限制。 具体而言， 中的 函数在执行拼接切片操作时，未检查组合后的总长度。由于输入数据会在 之前到达 、 和 ，因此攻击者无需提供有效的加密证明即可触发此

CVSS 3.7 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54542

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
Source: CVE Program / CVE List V5
Vulnerability Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nimiq core-rs-albatross < 1.6.0 -

II. Public POCs for CVE-2026-54542

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54542

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54542 (2)

Vendor Advisories for CVE-2026-54542 (1)

Vendor Pages for CVE-2026-54542 (1)

IV. Related Vulnerabilities

Same product: core-rs-albatross
Same vendor: nimiq
Same weakness: CWE-125

V. Comments for CVE-2026-54542

No comments yet

Leave a comment