nimiq-primitives CVE-2026-54542
LOW
GHSA-5rg2-xv9j-gv5p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attacker must be positioned as a network sync peer (AC:H, PR:N); only transient availability impact with no confidentiality or integrity effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Impact
A malicious peer acting as a state-sync source can crash a syncing node with a crafted TrieChunk whose proof contains a TrieNodeChild whose suffix, when concatenated with the parent key via KeyNibbles::Add, exceeds the fixed 63-byte backing array. Add (primitives/src/key_nibbles.rs:332 / :341) indexes bytes[self.bytes_len()..self.bytes_len() + other.bytes_len()] with no combined-length check, causing an out-of-bounds slice panic (both the even- and odd-length branches).
KeyNibbles deserialization validates only the individual length <= 126, not the combined parent + suffix length. The panic occurs at put_chunk → child.key() → is_stump() → +, i.e. before proof.verify(), so no valid proof is required. As with the related child_index issue, exploitation requires being the victim's sync peer during state sync, and the resulting crash is transient (the node restarts and re-syncs).
Affected: core-rs-albatross <= 1.5.1 (nimiq-primitives).
Patches
Fixed in 1.6.0 via https://github.com/nimiq/core-rs-albatross/pull/3790 (commit eabfc3e2), which guards key-nibble concatenation against exceeding the maximum length instead of indexing out of bounds.
Workarounds
None other than syncing only from trusted peers. Upgrade to 1.6.0.
AnalysisAI
Crash-inducing out-of-bounds panic in core-rs-albatross 1.5.1 and earlier allows a malicious state-sync peer to repeatedly restart a syncing Nimiq node without supplying a valid cryptographic proof. The panic fires in KeyNibbles::Add before proof.verify() is reached, meaning an unauthenticated network peer positioned as the victim's sync source can trigger the denial-of-service with a single crafted TrieChunk message. No CISA KEV listing exists and no public exploit code has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the nimiq-primitives Rust crate (CPE: pkg:rust/nimiq-primitives), part of the Nimiq blockchain's core-rs-albatross node implementation. KeyNibbles is a fixed-capacity trie key structure backed by a 63-byte array (126 nibbles maximum). The Add operator at primitives/src/key_nibbles.rs:332/:341 slices bytes[self.bytes_len()..self.bytes_len() + other.bytes_len()] without first verifying that the combined nibble count fits within capacity. Deserialization of KeyNibbles enforces only that each individual value satisfies length <= 126, leaving the combined sum unchecked. CWE-125 (Out-of-bounds Read) manifests as a Rust slice-index panic at runtime. The exploitable call chain is put_chunk → TrieNodeChild::key() → is_stump() → KeyNibbles::Add, which executes entirely before proof.verify(), so no cryptographically valid Merkle proof is needed to trigger the fault. The fix in v1.6.0 introduces KeyNibbles::checked_add() and updates both is_stump() and key() to return an error rather than call the unchecked Add operator.
RemediationAI
Upgrade to core-rs-albatross version 1.6.0, which is the vendor-confirmed fixed release available at https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0. The patch (PR #3790, commit eabfc3e2 at https://github.com/nimiq/core-rs-albatross/pull/3790) introduces KeyNibbles::checked_add() and replaces unchecked Add calls in TrieNodeChild::key() and is_stump() with checked variants that return errors on overflow. If immediate upgrade is not feasible, the only documented workaround is to configure the node to sync exclusively from trusted, controlled peers, which reduces but does not eliminate exposure if a trusted peer is itself compromised or impersonated. No other compensating controls are identified by the vendor.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today