Vulnerability in Nimiq Core Rust Implementation of Proof-of-Stake Protocol
CVE-2026-33471
What is CVE-2026-33471?
The Nimiq core-rs-albatross, a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm, is susceptible to a design error in its quorum verification process. Specifically, the method SkipBlockProof::verify incorrectly computes quorum checks using BitSet.len(), leading to potential exploitation by malicious actors. This occurs when an attacker manages to verify a SkipBlockProof that includes MultiSignature.signers with out-of-range indices spaced by 65536. Such a scenario allows these inflated indices to collide with the same in-range u16 slot during aggregation, enabling a validator with significantly fewer real signers than required to deceptively pass the verification. This vulnerability was addressed in version 1.3.0, and no known workarounds exist.
Affected Version(s)
nimiq-block < 1.3.0