# CVE-2026-46545: Nimiq Albatross denial of service in MerkleRadixTrie synchronization

Source: https://junglewise.ai/threats/cve-2026-46545-nimiq-albatross-denial-of-service-in-merkleradixtrie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46545 · Severity: high · CVSS 7.5 · Published 2026-06-10

A vulnerability in the Nimiq blockchain software allows a malicious user to crash nodes that are joining or recovering on the network. By sending a specially crafted data packet during the synchronization process, an attacker can force the software to encounter an unhandled error, leading to a complete service shutdown. This impacts the availability of the network for new participants but does not expose private customer data.

Technologies: [nimiq-primitives (crates.io)](https://junglewise.ai/threats/technologies/nimiq-primitives), [Nimiq Albatross](https://junglewise.ai/threats/technologies/albatross), [Nimiq Primitives](https://junglewise.ai/threats/technologies/primitives). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-46545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46545 being exploited in the wild.

**How severe is CVE-2026-46545?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** nimiq-primitives (crates.io) < 1.5.0, SEMVER:introduced=0,fixed=1.5.0; Nimiq Albatross < 1.5.0; Nimiq Primitives < 1.5.0.

**Is there a fix for CVE-2026-46545?** Yes. nimiq-primitives (crates.io): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46545 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46545?** Check whether you run nimiq-primitives (crates.io), Nimiq Albatross or Nimiq Primitives at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nimiq-primitives (crates.io): upgrade to 1.5.0 or later

  ```sh
  cargo update -p nimiq-primitives
  ```


## Technical details

A denial-of-service vulnerability exists in the `MerkleRadixTrie::put_chunk` function of the Nimiq Albatross implementation. The root cause is a failure to reject items with an empty (ROOT) key during the state-sync process. When a malicious peer provides a chunk containing a ROOT-keyed item, the `put_raw` function eventually calls `TrieNode::put_value(...).unwrap()`. Because the root node cannot hold a value, this returns an error that triggers a panic, crashing the node process. The attack is unauthenticated and can be executed by any peer responding to a synchronization request. The issue is fixed in version 1.5.0 by explicitly rejecting empty keys in incoming chunks.

## Affected products

- Nimiq Nimiq Albatross (core-rs-albatross) < 1.5.0

## Identifiers

- CVE-2026-46545
- GHSA-mw3q-r9wh-h2ff

## Timeline

- 2026-05-06: patched: Fix merged in pull request #3762
- 2026-05-07: advisory: Version 1.5.0 released
- 2026-05-15: disclosed: GitHub Security Advisory published
- 2026-06-10: advisory: CVE-2026-46545 published to NVD

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3762](https://github.com/nimiq/core-rs-albatross/pull/3762)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-mw3q-r9wh-h2ff](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-mw3q-r9wh-h2ff)

## Related threats

- [Nimiq nimiq-primitives out-of-bounds panic in KeyNibbles::Add](https://junglewise.ai/threats/cve-2026-54542-nimiq-nimiq-primitives-out-of-bounds-panic-in-keynibbles-add)
- [Nimiq nimiq-primitives panic in TrieProof::verify](https://junglewise.ai/threats/cve-2026-54541-nimiq-nimiq-primitives-panic-in-trieproof-verify)
- [Nimiq core-rs-albatross DHT query poisoning in handle_dht_get](https://junglewise.ai/threats/cve-2026-46541-nimiq-core-rs-albatross-dht-query-poisoning-in-handle-dht-get)
- [Nimiq Albatross state synchronization failure in LightBlockchain rebranch](https://junglewise.ai/threats/cve-2026-46540-nimiq-albatross-state-synchronization-failure-in-lightblockchain)
- [Nimiq BlockInclusionProof cryptographic bypass in nimiq-primitives](https://junglewise.ai/threats/cve-2026-46539-nimiq-blockinclusionproof-cryptographic-bypass-in-nimiq)