CVE-2026-32605: Nimiq Core-rs-albatross DoS Vulnerability

CVE-2026-32605 Overview

CVE-2026-32605 is an out-of-bounds read vulnerability affecting nimiq/core-rs-albatross, the Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator node by publishing a specially crafted signed Tendermint proposal message. The vulnerability exists in the ProposalSender::send function which uses an incorrect bounds check operator (> instead of >=), allowing a malicious signer value equal to validators.num_validators() to pass validation and trigger a panic when accessing an out-of-bounds array index.

Critical Impact

An unauthenticated remote attacker can crash Nimiq validator nodes, disrupting network consensus and causing denial of service to the blockchain network without any signature verification occurring.

Affected Products

• nimiq/core-rs-albatross versions prior to 1.3.0
• Nimiq Proof-of-Stake validator nodes running vulnerable versions
• Nodes participating in Albatross consensus protocol

Discovery Timeline

• April 13, 2026 - CVE CVE-2026-32605 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32605

Vulnerability Analysis

This vulnerability is classified under CWE-125 (Out-of-bounds Read). The flaw resides in the bounds checking logic within the ProposalSender::send function of the Nimiq core-rs-albatross codebase. When processing incoming Tendermint proposal messages, the function validates the signer field against the total number of validators. However, the comparison uses a strictly greater-than operator (>) rather than a greater-than-or-equal operator (>=), creating an off-by-one error.

This off-by-one flaw allows a signer value exactly equal to validators.num_validators() to bypass the bounds check. Subsequently, when the code attempts to retrieve the validator using validators.get_validator_by_slot_band(signer), it triggers a panic due to accessing an index that is one position beyond the valid array bounds. Critically, this crash occurs before any cryptographic signature verification takes place, meaning an attacker does not need to possess valid signing keys to exploit this vulnerability.

Root Cause

The root cause is an incorrect boundary condition check in the ProposalSender::send function. The bounds validation logic uses a > comparison operator when it should use >=. When the signer value equals the exact count of validators (an invalid index since arrays are zero-indexed), the check passes incorrectly. The subsequent array access at this invalid index causes Rust's runtime bounds checking to trigger a panic, terminating the validator process. This is a classic off-by-one error in boundary validation logic.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker needs to craft a signed Tendermint proposal message with the signer field set to a value equal to validators.num_validators(). When this malicious message is received by a vulnerable validator node through the peer-to-peer network, the following sequence occurs:

1. The proposal message arrives at the target validator
2. The ProposalSender::send function processes the message
3. The bounds check (signer > validators.num_validators()) evaluates to false when signer equals the validator count
4. The code proceeds to call validators.get_validator_by_slot_band(signer) with an out-of-bounds index
5. Rust's runtime panics due to the invalid array access, crashing the validator process

No valid cryptographic signature is required because the crash occurs before signature verification. The vulnerability can be exploited by any network peer that can send proposal messages.

Detection Methods for CVE-2026-32605

Indicators of Compromise

• Unexpected validator node crashes or process terminations
• Panic messages in logs referencing array index out of bounds in validator-related functions
• Increased frequency of validator restarts without clear operational cause
• Network peers sending proposal messages with abnormally high signer values

Detection Strategies

• Monitor validator node logs for panic messages containing "index out of bounds" or related array access errors
• Implement alerting on unexpected validator process terminations or restart patterns
• Analyze network traffic for Tendermint proposal messages with signer values at or near validator count boundaries
• Deploy intrusion detection rules to flag proposal messages with suspicious signer field values

Monitoring Recommendations

• Set up automated health checks for validator node availability and process status
• Configure log aggregation to capture and alert on Rust panic traces from validator processes
• Monitor network consensus participation metrics for signs of repeated validator dropouts
• Track peer behavior patterns to identify sources of potentially malicious proposal messages

How to Mitigate CVE-2026-32605

Immediate Actions Required

• Upgrade nimiq/core-rs-albatross to version 1.3.0 or later immediately
• Review validator logs for any signs of previous exploitation attempts
• Consider temporarily restricting peer connections to trusted nodes if upgrade cannot be performed immediately
• Monitor validator uptime closely during the upgrade window

Patch Information

The vulnerability has been fixed in nimiq/core-rs-albatross version 1.3.0. The fix corrects the boundary condition check in the ProposalSender::send function to use the proper >= comparison operator, ensuring that signer values equal to validators.num_validators() are correctly rejected as invalid.

For detailed information about the fix, refer to:

• GitHub Security Advisory GHSA-g99c-h7j7-rfhv
• GitHub Pull Request #3661
• GitHub Commit 9199364
• GitHub Release v1.3.0

Workarounds

• Deploy the patched version 1.3.0 as the primary mitigation; no official workarounds are available
• Implement network-level filtering to drop malformed proposal messages at the perimeter if possible
• Run validators behind a proxy that can validate message fields before forwarding to the validator node
• Configure automatic validator restart mechanisms to reduce downtime from potential exploitation

# Upgrade to patched version
cd core-rs-albatross
git fetch --tags
git checkout v1.3.0
cargo build --release