CVE-2026-32605

{
  "id": "CVE-2026-32605",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-13T20:16:33.787",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num_validators(). ProposalSender::send uses > instead of >= for the signer bounds check, so the equality case passes and reaches validators.get_validator_by_slot_band(signer), which panics with an out-of-bounds index before any signature verification runs. This issue has been fixed in version 1.3.0."
    },
    {
      "lang": "es",
      "value": "nimiq/core-rs-albatross es una implementación en Rust del protocolo Nimiq Proof-of-Stake basado en el algoritmo de consenso Albatross. Antes de la versión 1.3.0, un par no confiable podría colapsar un validador al publicar un mensaje de propuesta tendermint firmado donde signer == validators.num_validators(). ProposalSender::send usa > en lugar de >= para la comprobación de límites del firmante, por lo que el caso de igualdad pasa y llega a validators.get_validator_by_slot_band(signer), lo que provoca un pánico con un índice fuera de límites antes de que se ejecute cualquier verificación de firma. Este problema ha sido solucionado en la versión 1.3.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nimiq",
          "product": "core-rs-albatross",
          "versions": [
            {
              "version": "< 1.3.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-16T13:20:25.349665Z",
          "id": "CVE-2026-32605",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-193"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*",
              "versionEndExcluding": "1.3.0",
              "matchCriteriaId": "CD0CAAD1-7626-4A4A-A6F8-9DC46FE50731"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nimiq/core-rs-albatross/commit/9199364b60c7acae4219800d194bbe07d2997b8c",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nimiq/core-rs-albatross/pull/3661",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g99c-h7j7-rfhv",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}