Executive Summary

CVE-2026-46545 is a high-severity denial-of-service vulnerability in the Nimiq blockchain's core-rs-albatross implementation. It affects the MerkleRadixTrie::put_chunk function, where a remote, unauthenticated attacker can send a maliciously crafted chunk to crash nodes performing state synchronization.

The attack works by sending a ResponseChunk containing a TrieItem.key set to the empty (ROOT) key. This chunk passes validation but causes a panic when the node tries to store a value at the root node, leading to a process abort.

This vulnerability impacts nodes syncing state from untrusted peers, such as fresh nodes joining the network or nodes recovering from data loss. Honest nodes do not generate such ROOT-keyed items, so non-syncing operations are unaffected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service by crashing any node performing state synchronization in the Nimiq network. This includes nodes that are freshly joining or recovering from data loss.

An attacker can remotely and without authentication send malicious chunks that cause the node's process to abort, disrupting the node's ability to sync and participate in the network.

There are no safe in-process workarounds, so affected nodes must upgrade to version 1.5.0 or later to mitigate the issue.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for crashes or panics in nodes performing state synchronization, especially when receiving ResponseChunk messages containing a TrieItem.key set to the empty (ROOT) key.

Since the attack involves a maliciously crafted chunk sent by a remote peer, detection involves inspecting network traffic for ResponseChunk messages with suspicious empty keys or monitoring logs for panic events related to MerkleRadixTrie::put_chunk.

Specific commands are not provided in the resources, but general approaches include:

• Use network packet capture tools (e.g., tcpdump or Wireshark) to filter and analyze traffic to/from nodes for unusual ResponseChunk payloads.
• Check node logs for panic or crash messages related to trie.rs or MerkleRadixTrie::put_chunk.
• Use process monitoring tools (e.g., systemctl status, journalctl, or docker logs) to detect unexpected node restarts or crashes.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Nimiq core-rs-albatross implementation to version 1.5.0 or later, where the vulnerability has been patched.

There are no safe in-process workarounds available to prevent the crash caused by malicious chunks.

After upgrading, ensure that nodes only synchronize state with trusted peers to minimize exposure to maliciously crafted chunks.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0