CVE-2026-46545: Nimiq Albatross denial of service in MerkleRadixTrie synchronization

CVE-2026-46545 · Severity: high · CVSS 7.5 · Published 2026-06-10

A vulnerability in the Nimiq blockchain software allows a malicious user to crash nodes that are joining or recovering on the network. By sending a specially crafted data packet during the synchronization process, an attacker can force the software to encounter an unhandled error, leading to a complete service shutdown. This impacts the availability of the network for new participants but does not expose private customer data.

Technologies: nimiq-primitives (crates.io), Nimiq Albatross, Nimiq Primitives. Vendors: crates.io, Nimiq.

Quick answers

Is CVE-2026-46545 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46545 being exploited in the wild.
How severe is CVE-2026-46545?
High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?
nimiq-primitives (crates.io) < 1.5.0, SEMVER:introduced=0,fixed=1.5.0; Nimiq Albatross < 1.5.0; Nimiq Primitives < 1.5.0.
Is there a fix for CVE-2026-46545?
Yes. nimiq-primitives (crates.io): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46545 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46545?
Check whether you run nimiq-primitives (crates.io), Nimiq Albatross or Nimiq Primitives at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nimiq-primitives (crates.io): upgrade to 1.5.0 or later
    cargo update -p nimiq-primitives

Technical details

A denial-of-service vulnerability exists in the `MerkleRadixTrie::put_chunk` function of the Nimiq Albatross implementation. The root cause is a failure to reject items with an empty (ROOT) key during the state-sync process. When a malicious peer provides a chunk containing a ROOT-keyed item, the `put_raw` function eventually calls `TrieNode::put_value(...).unwrap()`. Because the root node cannot hold a value, this returns an error that triggers a panic, crashing the node process. The attack is unauthenticated and can be executed by any peer responding to a synchronization request. The issue is fixed in version 1.5.0 by explicitly rejecting empty keys in incoming chunks.

Affected products

  • Nimiq Nimiq Albatross (core-rs-albatross) < 1.5.0

Identifiers

  • CVE-2026-46545
  • GHSA-mw3q-r9wh-h2ff

Timeline

  • 2026-05-06: patched: Fix merged in pull request #3762
  • 2026-05-07: advisory: Version 1.5.0 released
  • 2026-05-15: disclosed: GitHub Security Advisory published
  • 2026-06-10: advisory: CVE-2026-46545 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.