PT-2026-30251 · Pypi · Core-Rs-Albatross
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
nimiq/core-rs-albatross versions prior to 1.3.0
Description
The discovery handler accepts a peer-controlled limit during the handshake process and stores it without validation. When a peer sets the limit to 0, the initial HandshakeAck path returns zero contacts, masking the issue. However, once the session reaches the Established state, the periodic update path performs a subtraction operation on the limit (
usize - 1). A limit of 0 causes an integer wrap-around to usize::MAX. Subsequently, the choose multiple() function attempts to allocate memory using Vec::with capacity(amount), leading to a deterministic panic due to capacity overflow.Recommendations
Update nimiq/core-rs-albatross to version 1.3.0.
Exploit
Fix
Integer Underflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Core-Rs-Albatross