GHSA-46wq-28cx-mhw4

Suggest an improvement
Source
https://github.com/advisories/GHSA-46wq-28cx-mhw4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-46wq-28cx-mhw4/GHSA-46wq-28cx-mhw4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-46wq-28cx-mhw4
Aliases
Published
2026-07-16T20:03:00Z
Modified
2026-07-16T20:26:44Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys
Details

Impact

A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted TrieChunk whose proof contains two TrieProofNodes with identical keys. TrieProof::verify() calls TrieProofNode::child_index() (primitives/src/trie/trie_proof_node.rs:94), which unconditionally unwraps KeyNibbles::get(self.key.len()). Because is_prefix_of returns true for two equal keys, execution reaches get(len), which returns None, and the unwrap() panics.

The panic is reached from untrusted network input (ResponseChunk → commit_chunks → put_chunk → proof.verify()) before any cryptographic proof verification, so the attacker does not need to produce a valid proof. Exploitation requires the attacker to be selected as the victim's sync peer while the victim is performing state sync, and the resulting crash is transient (the node restarts and re-syncs).

Affected: core-rs-albatross <= 1.5.1 (nimiq-primitives).

Patches

Fixed in 1.6.0 via https://github.com/nimiq/core-rs-albatross/pull/3789 (commit 41d35ace). child_index now rejects equal-length keys and returns MerkleRadixTrieError::WrongPrefix instead of unwrapping.

Workarounds

None other than syncing only from trusted peers. Upgrade to 1.6.0.

Database specific 
{
    "cwe_ids":  [
        "CWE-248"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-16T20:03:00Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

crates.io / nimiq-primitives

Package

Name
nimiq-primitives
View open source insights on deps.dev
Purl
pkg:cargo/nimiq-primitives

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-46wq-28cx-mhw4/GHSA-46wq-28cx-mhw4.json"