Core Rs Albatross CVE-2026-33184

Remote unauthenticated attacker exploiting nimiq/core-rs-albatross versions prior to 1.3.0. Attacker sends crafted peer discovery handshake with limit=0, causing integer underflow during periodic peer list updates after session reaches Established state.

Real-world risk is MODERATE despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation with low complexity, and the High availability impact reflects the deterministic panic/crash. However, multiple factors limit practical severity: this affects only nodes running vulnerable Nimiq core-rs-albatross versions in peer-to-peer network roles, the attack produces only denial-of-service (no data compromise or code execution), node operators can rapidly restart crashed instances, and the Nimiq blockchain ecosystem has limited deployment compared to mainstream protocols. No EPSS score provided in input data, but the straightforward attack vector (single malformed handshake message) suggests moderate automatable potential. CISA KEV status is negative, indicating no confirmed active exploitation in the wild. The SSVC framework would classify this as Technical Impact: Partial (availability only), Automatable: Yes (simple network message), and Exploitation: None (no public POC despite GitHub advisory and commit disclosure). The attack requires network connectivity to target nodes but no authentication, making it accessible to any network participant. Priority should focus on environments running public Nimiq validators or full nodes exposed to untrusted peers, while private/permissioned deployments face minimal risk.

An attacker identifies publicly accessible Nimiq core-rs-albatross nodes via network scanning on the blockchain's peer-to-peer port. The attacker initiates a standard peer discovery handshake but injects peer_list_limit=0 in the handshake message. The target node accepts this value and completes the handshake, appearing to function normally. Minutes later, when the periodic peer list update routine executes on the now-Established session, the node attempts to subtract 1 from the stored limit of 0, causing integer wraparound to usize::MAX, then immediately panics when trying to allocate an 18-exabyte vector. The node crashes and becomes unavailable until manually restarted. No public exploit identified at time of analysis, but the attack requires only basic network protocol knowledge and could be scripted trivially.