CVE-2026-33184 nimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panic

High 7.5 Published 3 Apr 2026 Updated 6 Apr 2026

A remote attacker can crash the Nimiq node by sending a zero limit during handshake, causing an integer underflow and subsequent panic.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33184?

CVE-2026-33184 is a high-severity vulnerability in nimiq core-rs-albatross, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, the discovery handler accepts a peer-controlled limit during handshake and stores it unchanged. The immediate HandshakeAck path then honors limit = 0 and returns zero contacts, which makes the session look benign. Later, after the same session reaches Established, the periodic update path computes self.peer_list_limit.unwrap() as usize - 1. With limit = 0, that wraps to usize::MAX and then in rand 0.9.2, choose_multiple() immediately attempts Vec::with_capacity(amount), which deterministically panics with capacity overflow. This issue has been patched in version 1.3.0.

Weakness: CWE-191

Which versions are affected by CVE-2026-33184?

It affects 1 product.

Products include Nimiq Nimiq Proof-of-Stake.

How do I fix CVE-2026-33184?

No fix has been published for CVE-2026-33184 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33184 being exploited?

There is no known exploitation of CVE-2026-33184 in the wild and no public exploit code.

Sources

Also known as GHSA-5rm9-893q-vmhm.