PT-2026-42637 · Crates.Io · Nimiq-Primitives

Published

2026-05-21

·

Updated

2026-05-21

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

A remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes).
A malicious peer can respond to a RequestChunk with a ResponseChunk::Chunk whose first TrieItem.key is the empty (ROOT) key. The chunk passes sorting, range, and Merkle-proof validation, but when put raw tries to store a value at the root node, it calls TrieNode::put value(...).unwrap(), which returns Err(RootCantHaveValue) and panics, aborting the node process. The panic fires on the first malicious chunk the victim commits; no rate limit or authentication gate caps the attack.
Impacted: any node running state sync against untrusted peers — this includes fresh nodes performing initial download and existing nodes recovering from data loss. Honest nodes never construct ROOT-keyed items, so non-syncing operation is unaffected.

Patches

See PR.

Workarounds

There is no safe in-process workaround: any peer serving state-sync data can trigger the crash and the code path is not guarded by a feature flag.

Resources

  • Fix commit: (link to the merged PR commit, once merged)
  • Affected code: primitives/trie/src/trie.rs — put chunk (around line 819) and put raw (around line 351)

Fix

Weakness Enumeration

CWE-248

Related Identifiers

GHSA-MW3Q-R9WH-H2FF

Affected Products

Nimiq-Primitives