CVE-2026-54541
Received Received - Intake

Nimiq Proof-of-Stake State Sync Trie Proof Validation Flaw

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. TrieProof::verify calls TrieProofNode::child_index in primitives/src/trie/trie_proof_node.rs, where is_prefix_of accepts equal keys and KeyNibbles::get is called at the key length, returns None, and is unconditionally unwrapped. Untrusted ResponseChunk data reaches commit_chunks, put_chunk, and proof.verify before cryptographic proof validation, so the attacker does not need a valid proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync, and the resulting panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54541
EUVD
EUVD-2026-77576

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nimiq nimiq to 1.6.0 (exc)
nimiq core-rs-albatross 1.6.0
nimiq core-rs-albatross to 1.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Nimiq's core-rs-albatross affects versions before 1.6.0. A malicious peer can crash a syncing node by sending a crafted TrieChunk proof with two TrieProofNode values sharing identical keys. The TrieProof::verify function processes this data before cryptographic validation, causing a panic when unwrapping a None value from KeyNibbles::get due to equal key lengths. The node crashes but restarts and resynchronizes automatically.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes during state synchronization. Check logs for panics or restarts in Nimiq nodes during sync operations. No direct commands are provided, but watch for errors in primitives/src/trie/trie_proof_node.rs or related trie modules.

Impact Analysis

If you run a Nimiq node syncing from an untrusted peer, an attacker could crash your node by exploiting this flaw. The crash is temporary as the node restarts and resyncs, but it disrupts normal operation. Exploitation requires the attacker to be selected as your sync peer during state sync.

Compliance Impact

This vulnerability primarily causes transient node crashes during state synchronization, leading to reduced availability. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, repeated crashes could disrupt service availability, potentially affecting compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade to Nimiq core-rs-albatross version 1.6.0 or later. Avoid syncing from untrusted peers during state synchronization. If immediate upgrade is not possible, restrict sync peers to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart