Executive brief
A vulnerability in the Nimiq blockchain software allows a malicious user to crash nodes that are joining or recovering on the network. By sending a specially crafted data packet during the synchronization process, an attacker can force the software to encounter an unhandled error, leading to a complete service shutdown. This impacts the availability of the network for new participants but does not expose private customer data.
Technical details
A denial-of-service vulnerability exists in the `MerkleRadixTrie::put_chunk` function of the Nimiq Albatross implementation. The root cause is a failure to reject items with an empty (ROOT) key during the state-sync process. When a malicious peer provides a chunk containing a ROOT-keyed item, the `put_raw` function eventually calls `TrieNode::put_value(...).unwrap()`. Because the root node cannot hold a value, this returns an error that triggers a panic, crashing the node process. The attack is unauthenticated and can be executed by any peer responding to a synchronization request. The issue is fixed in version 1.5.0 by explicitly rejecting empty keys in incoming chunks.
Affected products
- Nimiq Nimiq Albatross (core-rs-albatross) < 1.5.0
Timeline
- 2026-05-06: patched: Fix merged in pull request #3762
- 2026-05-07: advisory: Version 1.5.0 released
- 2026-05-15: disclosed: GitHub Security Advisory published
- 2026-06-10: advisory: CVE-2026-46545 published to NVD