PT-2026-42672 · Unknown · Core-Rs-Albatross

Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-46545

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions core-rs-albatross (affected versions not specified)

Description A remote, unauthenticated denial-of-service issue exists in the MerkleRadixTrie::put chunk function. A malicious state-sync peer can cause a node to crash by responding to a RequestChunk with a ResponseChunk::Chunk where the first TrieItem.key is the empty (ROOT) key. Although the chunk passes sorting, range, and Merkle-proof validation, the put raw function attempts to store a value at the root node by calling TrieNode::put value(). This results in a RootCantHaveValue error and triggers a panic that aborts the node process. This affects any node performing state synchronization, including fresh nodes during initial download and existing nodes recovering from data loss.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2026-46545

GHSA-MW3Q-R9WH-H2FF

Affected Products

Core-Rs-Albatross

References · 7

• https://osv.dev/vulnerability/GHSA-mw3q-r9wh-h2ff · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-mw3q-r9wh-h2ff · Note
• https://github.com/nimiq/core-rs-albatross/pull/3762 · Note
• https://github.com/nimiq/core-rs-albatross/commit/0fb8766adea91e038af00e635a6eb92756e50172 · Note
• https://twitter.com/dailycve/status/2057569108061741557 · Twitter Post
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0 · Note