Peer-Controlled Limit Vulnerability in Nimiq Core Rust Implementation

CVE-2026-33184

What is CVE-2026-33184?

The Nimiq core-rs-albatross implementation, based on the Albatross consensus algorithm, has a vulnerability due to its handshake process. Prior to version 1.3.0, the discovery handler inadvertently accepts a peer-controlled limit without validation. This issue allows a limit of zero during the handshake, which later causes a calculation error when the session reaches an established state. The vulnerability can lead to a capacity overflow in the random library, resulting in a panic. The issue has been resolved in version 1.3.0, emphasizing the importance of updating to the latest version to mitigate associated risks.

References