Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M

CVE-2026-46545nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item

High 7.5

In plain English

A high-severity security flaw in core-rs-albatross from nimiq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes). This issue has been patched in version 1.5.0.

Affected products (as reported)

Vendor	Product	Versions
nimiq	core-rs-albatross	< 1.5.0

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-mw3q-r9wh-h2ff x_refsource_CONFIRM
https://github.com/nimiq/core-rs-albatross/pull/3762 x_refsource_MISC
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0 x_refsource_MISC