# CVE-2026-32605: Nimiq core-rs-albatross denial of service via off-by-one error

Source: https://junglewise.ai/threats/cve-2026-32605-nimiq-core-rs-albatross-denial-of-service-via-off-by-one-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-32605 · Severity: high · CVSS 7.5 · Published 2026-04-13

Nimiq Albatross is a blockchain protocol implementation used for processing cryptocurrency transactions. A vulnerability in the validator component allows an unauthenticated attacker to remotely crash the server by sending a specially crafted message. This results in a denial-of-service, potentially disrupting the consensus network and halting transaction processing.

Technologies: [Nimiq Proof-Of-Stake](https://junglewise.ai/threats/technologies/nimiq-proof-of-stake). Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-32605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32605 being exploited in the wild.

**How severe is CVE-2026-32605?** High severity, with a CVSS score of 7.5, published 13 April 2026.

**Which products and versions are affected?** Nimiq core-rs-albatross (nimiq-validator) < 1.3.0.

**Is there a fix for CVE-2026-32605?** A patch was published on 2026-03-27: Fix merged and version 1.3.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32605 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-32605?** Check whether you run Nimiq Proof-Of-Stake. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one error exists in the `ProposalSender::send` function within the `nimiq-validator` crate. The code uses a `>` operator instead of `>=` when performing a bounds check on the `signer` field of a Tendermint proposal message against the total number of validators. If an untrusted peer sends a message where the signer index is exactly equal to the number of validators, the check passes and triggers a call to `validators.get_validator_by_slot_band(signer)`. This results in an out-of-bounds index panic, crashing the process before signature verification occurs. The issue is fixed in version 1.3.0.

## Affected products

- Nimiq core-rs-albatross (nimiq-validator) < 1.3.0

## Timeline

- 2026-03-27: patched: Fix merged and version 1.3.0 released
- 2026-04-11: advisory: GitHub Security Advisory published
- 2026-04-13: disclosed: CVE-2026-32605 published

## References

- [https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c](https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c)
- [https://github.com/nimiq/core-rs-albatross/pull/3661](https://github.com/nimiq/core-rs-albatross/pull/3661)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv)

## Related threats

- [nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge](https://junglewise.ai/threats/cve-2026-34068-nimiq-transaction-updatevalidator-transactions-allows-voting-key)
- [nimiq-transaction: Panic via `HistoryTreeProof` length mismatch](https://junglewise.ai/threats/cve-2026-34067-nimiq-transaction-panic-via-historytreeproof-length-mismatch)
- [nimiq-blockchain: Peer-triggerable panic during history sync](https://junglewise.ai/threats/cve-2026-34066-nimiq-blockchain-peer-triggerable-panic-during-history-sync)
- [nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals](https://junglewise.ai/threats/cve-2026-34065-nimiq-primitives-node-crash-due-to-missing-interlink-validation)
- [nimiq-account: Vesting insufficient funds error can panic](https://junglewise.ai/threats/cve-2026-34064-nimiq-account-vesting-insufficient-funds-error-can-panic)