EUVD-2026-22061Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover Nimiq validator via P2P peer discovery
-
ExploitCraft Tendermint proposal with signer=num_validators()
-
ExecutionSend message to validator node
-
ImpactTrigger out-of-bounds panic in ProposalSender::
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a Nimiq blockchain validator node running core-rs-albatross prior to version 1.3.0 and actively participating in consensus (listening for Tendermint proposal messages on the peer-to-peer network). No special configuration, feature flags, or deployment modes are required-this affects default validator operations. The attacker needs network connectivity to the validator's P2P port (typically via the Nimiq network protocol) to deliver the malformed proposal message. |
| Impact | Real-world risk assessment reveals a moderate-priority issue despite the CVSS base score of 7.5 (High). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates maximum exploitability (network-accessible, low complexity, no authentication, no user interaction) but impact limited to availability. The EPSS score of 0.04% (12th percentile) suggests extremely low probability of exploitation in the wild, consistent with the narrow attack surface-only Nimiq blockchain validators running core-rs-albatross are exposed. No CISA KEV listing and no public exploit code identified at time of analysis. The vulnerability is easily exploitable (send one malformed network message) but requires targeting a specific blockchain ecosystem with limited deployment compared to mainstream infrastructure. For organizations running Nimiq validators, this is a critical patch priority due to potential consensus disruption; for general enterprise networks, the risk is negligible. The SSVC framework would classify this as automatable (can script the crafted message), with high technical impact (validator crash) but low exploitation status (no observed activity) and narrow scope (Nimiq-specific deployment), yielding a 'scheduled' patching priority rather than 'immediate' for most contexts. |
| Exploit ScenarioDerived | An attacker identifies a Nimiq core-rs-albatross validator node on the network (typically via blockchain peer discovery). The attacker crafts a Tendermint proposal message with the signer field set to exactly validators.num_validators() (e.g., if the validator set size is 100, signer=100). When the validator receives and processes this message, the flawed bounds check allows execution to proceed to the array access, triggering a panic and crashing the validator process. This disrupts the validator's participation in consensus and could be repeated to cause persistent denial of service. No authentication is required, and the attack can be automated to target multiple validators simultaneously. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
Nimiq core-rs-albatross validators prior to version 1.3.0 can be remotely crashed via malformed Tendermint proposals. An unauthenticated network attacker exploits an off-by-one bounds check error (using > instead of >=) to trigger an out-of-bounds index panic before signature verification occurs. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and EPSS 0.04%, this represents a straightforward denial-of-service vector against Proof-of-Stake validators in the Nimiq blockchain network, though no public exploit
Earlier versions of this analysis (1)
Nimiq core-rs-albatross validators prior to version 1.3.0 can be remotely crashed via malformed Tendermint proposals. An unauthenticated network attacker exploits an off-by-one bounds check error (using > instead of >=) to trigger an out-of-bounds index panic before signature verification occurs. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and EPSS 0.04%, this represents a straightforward denial-of-service vector against Proof-of-Stake validators in the Nimiq blockchain network, though no public exploit or active exploitation has been identified. Vendor-released patch available in version 1.3.0.
RemediationAI
Upgrade to Nimiq core-rs-albatross version 1.3.0 or later, released January 2025, which corrects the bounds check from > to >= in ProposalSender::send. The fix is documented in GitHub pull request #3661 (https://github.com/nimiq/core-rs-albatross/pull/3661) and commit 9199364b60c7acae4219800d194bbe07d2997b8c (https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c). Release notes are available at https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0. No workarounds are documented; patching is the only remediation. Validator operators should prioritize this update to prevent service disruption during consensus operations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nimiq core-rs-albatross implements the Albatross consensus algorithm, a Proof-of-Stake blockchain protocol written in Rust. The vulnerability resides in the Tendermint proposal message handling logic within ProposalSender::send. The code performs a bounds check on the signer field against validators.num_validators() using a greater-than comparison (signer > num_validators) rather than greater-than-or-equal (signer >= num_validators). When an attacker sets signer exactly equal to num_validators(), the validation passes incorrectly, allowing execution to proceed to validators.get_validator_by_slot_band(signer). Since valid validator indices are zero-based (0 to num_validators-1), this causes an out-of-bounds array access. Rust's panic-on-out-of-bounds behavior terminates the validator process immediately, before the code reaches any cryptographic signature verification that would reject the malicious message. This is classified as CWE-125 (Out-of-bounds Read), though the immediate impact is availability disruption rather than information disclosure, as the panic occurs before data exfiltration. The affected product is identified by CPE cpe:2.3:a:nimiq:core-rs-albatross:*:*:*:*:*:*:*:*, covering all versions prior to the 1.3.0 fix.
Know when Core Rs Albatross gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.
Executive ViewAI
Nimiq core-rs-albatross validators below version 1.3.0 are vulnerable to remote denial-of-service attacks through malformed Tendermint proposals, potentially disrupting consensus participation and validator availability across the Nimiq blockchain network. An unauthenticated attacker can crash validators without authentication, impacting organizational validators' operational continuity and staking rewards.
Apply vendor patch. Until patching completes: implement network-level ingress filtering to restrict Tendermint proposal traffic to trusted peer validators only; deploy monitoring alerting on validator crash events; maintain validator redundancy to absorb individual node unavailability from denial-of-service events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Core Rs Albatross
View allInteger truncation in Nimiq core-rs-albatross's skip block proof verification allows authenticated validators to forge c
Timestamp manipulation in Nimiq Core Rust implementation (nimiq-blockchain 1.3.0 and earlier) allows authenticated block
Integer underflow in Nimiq core-rs-albatross <1.3.0 enables unauthenticated remote attackers to trigger deterministic de
Denial of service in Nimiq Core RS Albatross prior to version 1.3.0 allows remote attackers to crash full nodes by sendi
Elected validator proposers in nimiq/core-rs-albatross before version 1.3.0 can submit election macro blocks with malfor
Panic-triggered denial of service in Nimiq's core-rs-albatross (versions prior to 1.4.0) allows a network-level attacker
Exploit-DB