{"id":"CVE-2026-32605","aliases":["EUVD-2026-22061","GHSA-g99c-h7j7-rfhv"],"status":"published","title":"Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses \u003e instead of \u003e= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00471,"percentile":0.41267,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-193"],"published":"2026-04-13T18:54:58Z","modified":"2026-10-28T02:30:21Z","products":[{"vendor":"nimiq","product":"core-rs-albatross"},{"vendor":"nimiq","product":"nimiq_proof-of-stake"}],"references":[{"url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory"]},{"url":"https://github.com/nimiq/core-rs-albatross/pull/3661","tags":["x_refsource_MISC","Issue Tracking","Patch","fix"]},{"url":"https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32605.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32605","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32605","title":"Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses \u003e instead of \u003e= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.","status":"published","published":"2026-04-13T18:54:58.542Z","modified":"2026-04-16T13:26:40.93Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T14:19:57.100857Z"}],"euvd":[{"id":"EUVD-2026-22061","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses \u003e instead of \u003e= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.","status":"published","published":"2026-04-13T18:54:58Z","modified":"2026-04-16T13:26:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:24.386229Z"}],"nvd":[{"id":"CVE-2026-32605","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses \u003e instead of \u003e= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.","status":"published","published":"2026-04-13T20:16:33.787Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T14:12:14.37744Z"}],"osv":[{"id":"CVE-2026-32605","title":"Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer","description":"nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses \u003e instead of \u003e= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0.","status":"published","published":"2026-04-13T18:54:58.542Z","modified":"2026-10-28T02:30:21.044110042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-193"],"updated_at":"2026-11-02T15:45:01.548715Z"}]}}