Rust Implementation Vulnerability in Nimiq Proof-of-Stake Protocol by Nimiq

CVE-2026-32605

What is CVE-2026-32605?

The Rust implementation of the Nimiq Proof-of-Stake protocol, known as core-rs-albatross, contains a significant vulnerability that allows an untrusted peer to crash a validator. This is achieved by sending a signed tendermint proposal message where the signer is equal to the number of validators. Due to a coding oversight, the bounds check in the ProposalSender::send method uses a greater-than operator instead of greater-than-or-equal. Consequently, this loophole permits a scenario where the equality case passes without proper signature verification, leading to an out-of-bounds index access when the validator list is accessed. This flaw has been rectified in version 1.3.0.

References