CVE-2026-32605

// Conceptual PoC demonstrating the logic flaw // Simulating the vulnerable code flow in ProposalSender::send fn exploit_vulnerability(num_validators: usize) { // Attacker controls the 'signer' field in the message let malicious_signer = num_validators; println!("Attempting to send proposal with signer index: {}", malicious_signer); // VULNERABLE CHECK: Uses > instead of >= // If signer == num_validators, this condition is false, so the check passes. if malicious_signer > num_validators { println!("Check failed: Invalid signer index."); return; } println!("Check passed. Proceeding to access validator..."); // This function call triggers the panic (index out of bounds) // because valid indices are 0..num_validators. // In the real code: validators.get_validator_by_slot_band(signer) let validator_data = get_validator_by_slot_band(malicious_signer); println!("Validator data: {:?}", validator_data); } // Helper function to simulate the panic fn get_validator_by_slot_band(index: usize) -> &'static str { // Simulating a fixed-size array of validators let validators = ["Validator0", "Validator1", "Validator2"]; // This will panic if index >= validators.len() // In Rust, this triggers a thread panic &validators[index] } fn main() { // Assume the network has 3 validators (indices 0, 1, 2) let total_validators = 3; // Exploit attempt: Sending signer index = 3 triggers the crash exploit_vulnerability(total_validators); }

{"cve": {"id": "CVE-2026-32605", "sourceIdentifier": "[email protected]", "published": "2026-04-13T20:16:33.787", "lastModified": "2026-04-24T17:11:26.693", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-193"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*", "versionEndExcluding": "1.3.0", "matchCriteriaId": "CD0CAAD1-7626-4A4A-A6F8-9DC46FE50731"}]}]}], "references": [{"url": "https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/nimiq/core-rs-albatross/pull/3661", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}