CVE-2026-33184: Nimiq core-rs-albatross integer underflow in discovery handler

CVE-2026-33184 · Severity: high · CVSS 7.5 · Published 2026-04-03

Nimiq core-rs-albatross is a software implementation of the Nimiq blockchain protocol. A security flaw allows a remote attacker to crash a Nimiq node by sending a specially crafted handshake message. This results in a denial-of-service, potentially disrupting the node's ability to participate in the blockchain network and process transactions.

Technologies: Nimiq Albatross, Nimiq Proof-Of-Stake. Vendors: Nimiq.

Quick answers

Is CVE-2026-33184 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33184 being exploited in the wild.
How severe is CVE-2026-33184?
High severity, with a CVSS score of 7.5, published 3 April 2026.
Which products and versions are affected?
Nimiq Albatross < 1.3.0.
Is there a fix for CVE-2026-33184?
A patch was published on 2026-03-27: Fix merged into main branch and version 1.3.0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33184 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33184?
Check whether you run Nimiq Albatross or Nimiq Proof-Of-Stake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability (CWE-191) exists in the discovery handler of nimiq/core-rs-albatross. During the handshake process, the handler accepts a peer-controlled 'limit' value and stores it without validation. If a peer provides a limit of 0, the session initially appears benign; however, a subsequent periodic update path performs a subtraction (limit - 1) on the unsigned integer, causing it to wrap to usize::MAX. This massive value is then passed to a random selection function that attempts to allocate a vector with that capacity, resulting in a deterministic 'capacity overflow' panic and process crash. The vulnerability is reachable over the network without authentication. It has been patched in version 1.3.0 by clamping the peer-supplied limit and using saturating subtraction.

Affected products

  • Nimiq core-rs-albatross < 1.3.0

Timeline

  • 2026-03-27: patched: Fix merged into main branch and version 1.3.0 released.
  • 2026-04-02: advisory: GitHub Security Advisory GHSA-5rm9-893q-vmhm published.
  • 2026-04-03: disclosed: CVE-2026-33184 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.