GHSA-mw3q-r9wh-h2ff

Suggest an improvement
Source
https://github.com/advisories/GHSA-mw3q-r9wh-h2ff
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mw3q-r9wh-h2ff/GHSA-mw3q-r9wh-h2ff.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mw3q-r9wh-h2ff
Aliases
Published
2026-05-21T19:50:31Z
Modified
2026-06-10T13:45:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item
Details

Impact

A remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes).

A malicious peer can respond to a RequestChunk with a ResponseChunk::Chunk whose first TrieItem.key is the empty (ROOT) key. The chunk passes sorting, range, and Merkle-proof validation, but when put_raw tries to store a value at the root node, it calls TrieNode::put_value(...).unwrap(), which returns Err(RootCantHaveValue) and panics, aborting the node process. The panic fires on the first malicious chunk the victim commits; no rate limit or authentication gate caps the attack.

Impacted: any node running state sync against untrusted peers — this includes fresh nodes performing initial download and existing nodes recovering from data loss. Honest nodes never construct ROOT-keyed items, so non-syncing operation is unaffected.

Patches

See PR.

Workarounds

There is no safe in-process workaround: any peer serving state-sync data can trigger the crash and the code path is not guarded by a feature flag.

Resources

  • Fix commit: (link to the merged PR commit, once merged)
  • Affected code: primitives/trie/src/trie.rs — put_chunk (around line 819) and put_raw (around line 351)
Database specific 
{
    "cwe_ids":  [
        "CWE-248"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-21T19:50:31Z",
    "nvd_published_at":  "2026-06-10T00:16:54Z",
    "severity":  "HIGH"
}
References

Affected packages

crates.io / nimiq-primitives

Package

Name
nimiq-primitives
View open source insights on deps.dev
Purl
pkg:cargo/nimiq-primitives

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mw3q-r9wh-h2ff/GHSA-mw3q-r9wh-h2ff.json"