nimiq core-rs-albatross up to 1.2.x nimiq Proof-of-Stake Protocol self.peer_list_limit.unwrap integer underflow

Summaryinfo

A vulnerability classified as problematic has been found in nimiq core-rs-albatross up to 1.2.x. The impacted element is the function self.peer_list_limit.unwrap of the component nimiq Proof-of-Stake Protocol Handler. Performing a manipulation results in integer underflow. This vulnerability was named CVE-2026-33184. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in nimiq core-rs-albatross up to 1.2.x. It has been classified as problematic. This affects the function self.peer_list_limit.unwrap of the component nimiq Proof-of-Stake Protocol Handler. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on availability. The summary by CVE is:

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the discovery handler accepts a peer-controlled limit during handshake and stores it unchanged. The immediate HandshakeAck path then honors limit = 0 and returns zero contacts, which makes the session look benign. Later, after the same session reaches Established, the periodic update path computes self.peer_list_limit.unwrap() as usize - 1. With limit = 0, that wraps to usize::MAX and then in rand 0.9.2, choose_multiple() immediately attempts Vec::with_capacity(amount), which deterministically panics with capacity overflow. This issue has been patched in version 1.3.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-33184 since 03/17/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.3.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 8f60a2d75b74b55764ecf34bd4435f4961630595 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• nimiq

Name

• core-rs-albatross

Version

• 1.0
• 1.1
• 1.2

License

• open-source

Website

• Product: https://github.com/nimiq/core-rs-albatross/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion