CVE-2026-32605

Katalog CVE

CVSS 7.5 · High EPSS 0,62%

Kerentanan Out-of-bounds Read pada nimiq proof-of-stake. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.

Rincian

Terbit di NVD

13 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-193: Off-by-one Error

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv patch · advisory vendor
• https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c patch
• https://github.com/nimiq/core-rs-albatross/pull/3661 issue tracking · patch
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 release notes