CVE-2026-54542
Received Received - Intake

State-Sync Crash in Nimiq via Malicious TrieChunk

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54542
EUVD
EUVD-2026-77574

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
nimiq nimiq to 1.6.0 (exc)
nimiq nimiq_primitives to 1.6.0 (exc)
nimiq nimiq_core_rs_albatross to 1.6.0 (exc)
nimiq nimiq_primitives 1.6.0
nimiq nimiq_core_rs_albatross 1.6.0
nimiq core-rs-albatross 1.6.0
nimiq primitives to 1.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds memory access issue in the Nimiq Proof-of-Stake protocol implementation. A malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk with a valid but oversized TrieNodeChild suffix. When combined with the parent key during processing, the total length exceeds the 63-byte KeyNibbles buffer limit, causing a panic. The issue occurs because concatenation checks are missing, allowing individually valid inputs to overflow when combined.

Detection Guidance

Detection requires monitoring for crashes during state sync operations. Check logs for panics related to KeyNibbles or trie operations. Ensure nodes are running version 1.6.0 or later. No specific commands are provided in the resources.

Impact Analysis

If you are running a Nimiq node version before 1.6.0, a malicious sync peer could crash your node during state synchronization. The crash is temporary as the node restarts and resynchronizes, but it disrupts normal operation. Exploitation requires the attacker to be selected as your sync peer, so syncing only from trusted peers mitigates the risk.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a low-severity out-of-bounds panic in a blockchain synchronization process. The issue causes transient node crashes but does not lead to data breaches or unauthorized access, which are primary concerns for these regulations.

Mitigation Strategies
  • Upgrade Nimiq core-rs-albatross to version 1.6.0 or later to apply the patch.
  • Restrict state sync to trusted peers only to prevent malicious synchronization attempts.
  • Monitor node logs for crashes during state sync and restart nodes if necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart