Nimiq core-rs-albatross CVE-2026-33471

Nimiq core-rs-albatross implements the Albatross Proof-of-Stake consensus algorithm in Rust. Skip block proofs use BLS threshold signatures where validator participation is tracked via BitSet indices representing validator slots. The vulnerability stems from CWE-20 (Improper Input Validation) where SkipBlockProof::verify performs quorum validation using BitSet.len() - which counts total set bits regardless of numeric value - but then iterates indices and casts each usize to u16 for slot lookup during signature aggregation. In Rust, usize-to-u16 casting truncates high-order bits, so indices differing by exact multiples of 65536 (2^16) collapse to identical u16 values. An attacker crafting a MultiSignature.signers BitSet with indices like {42, 65578, 131114} produces len()=3 for quorum calculation but all resolve to slot 42 during aggregation, allowing one validator's BLS signature multiplied by 3 to appear as three distinct validators. This breaks the 2f+1 Byzantine fault tolerance threshold central to Albatross consensus.