{"id":"CVE-2026-54542","title":"Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm","summary":"Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a Tr…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-125"],"vendor":"nimiq","product":"core-rs-albatross","affected":["core-rs-albatross < 1.6.0"],"patched":["nimiq-primitives 1.6.0"],"published":"2026-09-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:16:46.453","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54542","references":[{"url":"https://github.com/nimiq/core-rs-albatross/commit/eabfc3e21731b0628c3f933163a0f1e1864217bf","label":"security-advisories@github.com"},{"url":"https://github.com/nimiq/core-rs-albatross/pull/3790","label":"security-advisories@github.com"},{"url":"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rg2-xv9j-gv5p","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-5rg2-xv9j-gv5p"}],"tags":["nvd","cve.org","ghsa","rust"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-14T19:20:57.604270Z"},"aliases":["GHSA-5rg2-xv9j-gv5p"],"ecosystem":"rust","ingestedAt":"2026-07-16T20:58:03.022Z","epss":0.00275,"epssPercentile":0.20082,"slug":"CVE-2026-54542","body":"## Overview\n\nNimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54542)\n\nAffected packages:\n\n- `nimiq-primitives < 1.6.0`\n\nPatched in:\n\n- `nimiq-primitives 1.6.0`\n\nSource: https://github.com/advisories/GHSA-5rg2-xv9j-gv5p","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}