CVE-2026-54542: 
Rust vulnerability analysis and mitigation

CVE-2026-54542 is an out-of-bounds panic vulnerability in the nimiq-primitives crate of the Nimiq core-rs-albatross blockchain node implementation, specifically in the KeyNibbles::Add operation. A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild with an oversized suffix that, when concatenated with the parent key, exceeds the fixed 63-byte backing array. All versions of core-rs-albatross up to and including 1.5.1 (nimiq-primitives) are affected. The vulnerability was published on June 5, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Nimiq Advisory).

The root cause is an out-of-bounds read/slice panic (CWE-125) in KeyNibbles::Add (primitives/src/key_nibbles.rs:332/:341), which indexes bytes[self.bytes_len()..self.bytes_len() + other.bytes_len()] without checking whether the combined nibble length exceeds the 63-byte storage capacity. KeyNibbles deserialization only validates that each individual key has length <= 126 nibbles, but does not enforce that the sum of parent key and child suffix lengths stays within bounds. The panic is triggered along the call chain put_chunk → child.key() → is_stump() → + — critically, this occurs before proof.verify() is called, meaning no cryptographically valid proof is required to trigger the crash. Exploitation requires the attacker to be positioned as the victim node's state-sync peer during the sync process (GitHub Advisory, Fix Commit).

Successful exploitation causes the targeted Nimiq node to crash with an out-of-bounds slice panic during state synchronization. The crash is transient — the node automatically restarts and re-syncs — so there is no persistent data loss or corruption. There is no confidentiality or integrity impact; the sole consequence is a temporary availability disruption (denial of service) to the affected node. An attacker could repeatedly trigger this crash to delay or disrupt a node's ability to complete state sync (GitHub Advisory, Nimiq Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-54542. The CVE status is listed as "Reserved," and no EPSS score or CISA KEV catalog entry is available. Exploitation requires a high-complexity precondition: the attacker must be positioned as the victim node's active state-sync peer, which limits opportunistic exploitation. The attack requires no privileges and no user interaction, but the high attack complexity reflects the network positioning requirement (GitHub Advisory).

1. Positioning: Establish a network position as a state-sync peer for the target Nimiq node running core-rs-albatross <= 1.5.1 — for example, by operating a malicious node that the victim connects to during initial sync or re-sync.
2. Craft malicious TrieChunk: Construct a TrieChunk containing a TrieProof with a TrieNodeChild whose suffix field is a valid KeyNibbles value (individually passing the length <= 126 deserialization check) but whose concatenation with the proof node's parent key exceeds 126 nibbles (63 bytes).
3. Send crafted chunk: Serve the malicious TrieChunk to the syncing victim node in response to a state-sync request.
4. Trigger panic: The victim node processes the chunk via put_chunk → child.key() → is_stump() → KeyNibbles::Add, which attempts an out-of-bounds slice index and panics before any proof verification occurs, crashing the node process.
5. Repeat for sustained DoS: Since the crash is transient and the node restarts and re-syncs, repeat the attack each time the node reconnects to maintain a denial-of-service condition (GitHub Advisory, Fix Commit).

• Logs: Rust panic messages in node logs referencing key_nibbles.rs at lines 332 or 341, with messages such as index out of bounds or slice index out of range during state-sync operations.
• Process: Unexpected node process crashes and restarts during state synchronization, particularly when syncing from a newly connected peer.
• Network: Repeated state-sync session initiations from the same peer IP, especially if the node crashes shortly after each new sync session begins.

Upgrade nimiq-primitives (and core-rs-albatross) to version 1.6.0, which introduces KeyNibbles::checked_add to guard concatenation against exceeding the maximum nibble length, and routes TrieNodeChild::key and TrieNodeChild::is_stump through this safe method. The fix was merged via pull request #3790 (commit eabfc3e2). The only available workaround for operators unable to upgrade immediately is to configure nodes to sync only from explicitly trusted peers, reducing exposure to malicious sync sources (Nimiq Advisory, v1.6.0 Release).