Executive brief
A vulnerability in the Nimiq blockchain software allows a malicious network peer to crash a node during the synchronization process. By sending a specially crafted data chunk, an attacker can trigger an internal error that causes the syncing node to stop functioning. While the crash is temporary and the node will attempt to restart, it can disrupt operations and delay the synchronization of the blockchain state.
Technical details
An out-of-bounds read/panic exists in the `KeyNibbles::Add` function within `primitives/src/key_nibbles.rs`. The root cause is a lack of combined-length validation when concatenating a parent key with a child suffix from a `TrieChunk` proof, which can exceed the fixed 63-byte backing array. An attacker acting as a state-sync source can exploit this by providing a crafted proof; the panic occurs during deserialization before proof verification, meaning no valid cryptographic proof is required. The attack requires the victim to be in the state-sync phase and connected to the attacker's peer. The issue is fixed in version 1.6.0 by adding length checks during concatenation.
Affected products
- Nimiq nimiq-primitives <= 1.5.1
- Nimiq core-rs-albatross <= 1.5.1
Timeline
- 2026-06-05: disclosed
- 2026-07-16: advisory
- 2026-07-16: patched