# CVE-2026-33184: Nimiq core-rs-albatross integer underflow in discovery handler

Source: https://junglewise.ai/threats/cve-2026-33184-nimiq-core-rs-albatross-integer-underflow-in-discovery-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33184 · Severity: high · CVSS 7.5 · Published 2026-04-03

Nimiq core-rs-albatross is a software implementation of the Nimiq blockchain protocol. A security flaw allows a remote attacker to crash a Nimiq node by sending a specially crafted handshake message. This results in a denial-of-service, potentially disrupting the node's ability to participate in the blockchain network and process transactions.

Technologies: [Nimiq Albatross](https://junglewise.ai/threats/technologies/albatross), [Nimiq Proof-Of-Stake](https://junglewise.ai/threats/technologies/nimiq-proof-of-stake). Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-33184 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33184 being exploited in the wild.

**How severe is CVE-2026-33184?** High severity, with a CVSS score of 7.5, published 3 April 2026.

**Which products and versions are affected?** Nimiq Albatross < 1.3.0.

**Is there a fix for CVE-2026-33184?** A patch was published on 2026-03-27: Fix merged into main branch and version 1.3.0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33184 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33184?** Check whether you run Nimiq Albatross or Nimiq Proof-Of-Stake at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability (CWE-191) exists in the discovery handler of nimiq/core-rs-albatross. During the handshake process, the handler accepts a peer-controlled 'limit' value and stores it without validation. If a peer provides a limit of 0, the session initially appears benign; however, a subsequent periodic update path performs a subtraction (limit - 1) on the unsigned integer, causing it to wrap to usize::MAX. This massive value is then passed to a random selection function that attempts to allocate a vector with that capacity, resulting in a deterministic 'capacity overflow' panic and process crash. The vulnerability is reachable over the network without authentication. It has been patched in version 1.3.0 by clamping the peer-supplied limit and using saturating subtraction.

## Affected products

- Nimiq core-rs-albatross < 1.3.0

## Timeline

- 2026-03-27: patched: Fix merged into main branch and version 1.3.0 released.
- 2026-04-02: advisory: GitHub Security Advisory GHSA-5rm9-893q-vmhm published.
- 2026-04-03: disclosed: CVE-2026-33184 published to NVD.

## References

- [https://github.com/nimiq/core-rs-albatross/commit/8f60a2d75b74b55764ecf34bd4435f4961630595](https://github.com/nimiq/core-rs-albatross/commit/8f60a2d75b74b55764ecf34bd4435f4961630595)
- [https://github.com/nimiq/core-rs-albatross/pull/3664](https://github.com/nimiq/core-rs-albatross/pull/3664)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rm9-893q-vmhm](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-5rm9-893q-vmhm)

## Related threats

- [Nimiq Albatross denial of service in MerkleRadixTrie synchronization](https://junglewise.ai/threats/cve-2026-46545-nimiq-albatross-denial-of-service-in-merkleradixtrie)
- [Nimiq core-rs-albatross DHT query poisoning in handle_dht_get](https://junglewise.ai/threats/cve-2026-46541-nimiq-core-rs-albatross-dht-query-poisoning-in-handle-dht-get)
- [Nimiq Albatross state synchronization failure in LightBlockchain rebranch](https://junglewise.ai/threats/cve-2026-46540-nimiq-albatross-state-synchronization-failure-in-lightblockchain)
- [Nimiq core-rs-albatross denial of service in DHT record handling](https://junglewise.ai/threats/cve-2026-44505-nimiq-core-rs-albatross-denial-of-service-in-dht-record-handling)
- [nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge](https://junglewise.ai/threats/cve-2026-34068-nimiq-transaction-updatevalidator-transactions-allows-voting-key)