Junglewise Threat Intelligence

CVE-2026-33184: Nimiq core-rs-albatross integer underflow in discovery handler

CVE-2026-33184 · Severity: high · CVSS 7.5 · Published 2026-04-03

Technologies: Nimiq Albatross, Nimiq Proof-Of-Stake, Nimiq Core-Rs-Albatross. Vendors: Nimiq.

Executive brief

Nimiq core-rs-albatross is a software implementation of the Nimiq blockchain protocol. A security flaw allows a remote attacker to crash a Nimiq node by sending a specially crafted handshake message. This results in a denial-of-service, potentially disrupting the node's ability to participate in the blockchain network and process transactions.

Technical details

An integer underflow vulnerability (CWE-191) exists in the discovery handler of nimiq/core-rs-albatross. During the handshake process, the handler accepts a peer-controlled 'limit' value and stores it without validation. If a peer provides a limit of 0, the session initially appears benign; however, a subsequent periodic update path performs a subtraction (limit - 1) on the unsigned integer, causing it to wrap to usize::MAX. This massive value is then passed to a random selection function that attempts to allocate a vector with that capacity, resulting in a deterministic 'capacity overflow' panic and process crash. The vulnerability is reachable over the network without authentication. It has been patched in version 1.3.0 by clamping the peer-supplied limit and using saturating subtraction.

Affected products

  • Nimiq core-rs-albatross < 1.3.0

Timeline

  • 2026-03-27: patched: Fix merged into main branch and version 1.3.0 released.
  • 2026-04-02: advisory: GitHub Security Advisory GHSA-5rm9-893q-vmhm published.
  • 2026-04-03: disclosed: CVE-2026-33184 published to NVD.

References

Related threats