Core Rs Albatross CVE-2026-33184

Nimiq core-rs-albatross implements the Albatross proof-of-stake consensus algorithm for the Nimiq blockchain network. The vulnerability resides in the peer discovery handler's session lifecycle management. During the handshake phase, the handler accepts a peer_list_limit parameter from remote peers without validation and stores it directly. While the immediate HandshakeAck code path safely handles limit=0 by returning zero contacts, the code fails to validate this value before the session transitions to Established state. Once established, the periodic peer list update mechanism performs arithmetic: self.peer_list_limit.unwrap() as usize - 1. This operation exhibits classic CWE-191 (Integer Underflow/Wraparound) behavior - when limit=0, subtracting 1 wraps around to usize::MAX (18,446,744,073,709,551,615 on 64-bit systems). This massive value is then passed to the rand 0.9.2 crate's choose_multiple() function, which immediately attempts Vec::with_capacity(usize::MAX), triggering a deterministic panic due to capacity overflow. The vulnerability demonstrates improper input validation combined with unsafe arithmetic on untrusted network data in Rust's otherwise memory-safe environment.