Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-14T16:17:12.377Z",
  "pubdate": "2026-09-14T16:17:12.377Z",
  "executiveSummary": "The Nimiq implementation, prior to version 1.6.0, is susceptible to a denial-of-service vulnerability triggered by a malicious state-sync peer. The issue stems from an improper boundary check in the KeyNibbles manipulation logic during the processing of TrieChunk data.\nThe vulnerability is classified as an out-of-bounds (OOB) memory access, specifically an OOB panic. By sending a crafted TrieChunk that combines a parent key with a TrieNodeChild suffix exceeding the capacity of the 63-byte KeyNibbles backing array, an attacker can force a node to crash.\nThis vulnerability is particularly significant because the malicious payload is processed during the state synchronization phase before cryptographic verification (proof.verify) occurs. Consequently, an attacker does not require valid cryptographic keys to initiate the crash.\nThe impact is limited to a transient service interruption, as the affected node will panic, restart, and attempt to resynchronize. However, persistent targeting could lead to sustained unavailability of the node if the attacker manages to remain the selected sync peer. This affects Nimiq implementations utilizing the Albatross consensus algorithm before version 1.6.0.",
  "technicalDetails": "The vulnerability resides within the primitive handling of trie data structures, specifically in primitives/src/key_nibbles.rs. The underlying implementation of KeyNibbles uses a fixed-size backing array restricted to 63 bytes. The function KeyNibbles::Add fails to implement bounds checking when concatenating a parent key with a TrieNodeChild suffix.\nThe exploitation flow begins when an attacker acts as a state-sync peer to a target node. The target node requests a TrieChunk, providing the attacker the opportunity to inject a crafted packet. The crafted TrieChunk includes a TrieNodeChild suffix that, when appended to the parent key, results in a nibble sequence exceeding the 63-byte buffer limit of the KeyNibbles structure.\nBecause the vulnerable code execution path occurs within put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump prior to the invocation of proof.verify, the input data is processed without prior cryptographic authentication or structural integrity validation. This allows an unauthenticated, remote attacker to trigger the memory safety violation successfully.\nWhen the node attempts to perform the combined slice operation in KeyNibbles::Add, the operation exceeds the allocated buffer, triggering a Rust panic. In the context of the Nimiq node's execution environment, this panic causes an immediate process termination. While the node is programmed to restart and resynchronize automatically, the state-sync mechanism remains susceptible to re-exploitation by the same peer if the attacker is re-selected by the node's peer-selection logic.\nThe scope of this vulnerability is strictly limited to a denial-of-service condition; there is no evidence provided to suggest potential for remote code execution (RCE) or arbitrary memory read/write primitives, as the panic immediately halts execution. The vulnerability is successfully mitigated in version 1.6.0, where bounds checking is likely implemented to ensure that concatenations do not exceed the underlying array capacity."
}