CVE-2026-54542
Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof
Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose proof contains a TrieNodeChild suffix that is individually valid but exceeds the 63-byte KeyNibbles backing array when combined with the parent key. KeyNibbles::Add in primitives/src/key_nibbles.rs performs the combined slice operation without checking the total length, and the input reaches put_chunk, TrieNodeChild::key, and TrieNodeChild::is_stump before proof.verify, so the attacker does not need a valid cryptographic proof. Exploitation requires the attacker to be selected as the victim's sync peer during state sync. The resulting out-of-bounds panic is transient because the node restarts and resynchronizes. This issue is fixed in version 1.6.0.
INFO
Published Date :
Sept. 14, 2026, 3:29 p.m.
Last Modified :
Sept. 14, 2026, 3:29 p.m.
Remotely Exploit :
No
Source :
GitHub_M
Solution
- Update Nimiq to version 1.6.0 or later.
- Ensure nodes are configured to sync from trusted peers.
- Monitor sync peers during state synchronization.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54542 vulnerability anywhere in the article.