CVE-2026-33184 Nimiq core-rs-albatross 整数溢出致拒绝服务

// This is a conceptual Proof of Concept demonstrating the vulnerability trigger. // It simulates the vulnerable logic in nimiq/core-rs-albatross prior to v1.3.0. fn trigger_vulnerability(peer_limit: usize) { // Simulating the state where the session is Established // and the periodic update path is running. // The vulnerable code path calculates the amount for vector allocation // based on the peer-controlled limit. // Vulnerability: `peer_limit - 1` where peer_limit = 0 causes underflow. let amount = peer_limit - 1; println!("Allocating vector with capacity: {}", amount); // This mimics the call chain inside rand 0.9.2 choose_multiple() // Vec::with_capacity will panic if the calculation overflows/is too large. let _vec: Vec<u8> = Vec::with_capacity(amount); println!("Allocation successful (should not reach here if limit was 0)"); } fn main() { // Attack scenario: Peer sends limit = 0 during handshake let malicious_limit = 0; println!("Triggering vulnerability with limit = {}", malicious_limit); trigger_vulnerability(malicious_limit); }