{"id":"GHSA-mw3q-r9wh-h2ff","summary":"nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item","details":"### Impact\n\nA remote, unauthenticated denial-of-service vulnerability in `MerkleRadixTrie::put_chunk` allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes).\n\nA malicious peer can respond to a `RequestChunk` with a `ResponseChunk::Chunk` whose first `TrieItem.key` is the empty (ROOT) key. The chunk passes sorting, range, and Merkle-proof validation, but when `put_raw` tries to store a value at the root node, it calls `TrieNode::put_value(...).unwrap()`, which returns `Err(RootCantHaveValue)` and panics, aborting the node process. The panic fires on the first malicious chunk the victim commits; no rate limit or authentication gate caps the attack.\n\nImpacted: any node running state sync against untrusted peers — this includes fresh nodes performing initial download and existing nodes recovering from data loss. Honest nodes never construct ROOT-keyed items, so non-syncing operation is unaffected.\n\n### Patches\n\nSee [PR](https://github.com/nimiq/core-rs-albatross/pull/3762).\n\n### Workarounds\n\nThere is no safe in-process workaround: any peer serving state-sync data can trigger the crash and the code path is not guarded by a feature flag.\n\n### Resources\n\n- Fix commit: (link to the merged PR commit, once merged)\n- Affected code: [`primitives/trie/src/trie.rs`](https://github.com/nimiq/core-rs-albatross/blob/albatross/primitives/trie/src/trie.rs) — `put_chunk` (around line 819) and `put_raw` (around line 351)","aliases":["CVE-2026-46545"],"modified":"2026-06-10T13:45:16.346499475Z","published":"2026-05-21T19:50:31Z","database_specific":{"cwe_ids":["CWE-248"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-05-21T19:50:31Z","nvd_published_at":"2026-06-10T00:16:54Z"},"references":[{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-mw3q-r9wh-h2ff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46545"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/pull/3762"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/commit/0fb8766adea91e038af00e635a6eb92756e50172"},{"type":"PACKAGE","url":"https://github.com/nimiq/core-rs-albatross"},{"type":"WEB","url":"https://github.com/nimiq/core-rs-albatross/releases/tag/v1.5.0"}],"affected":[{"package":{"name":"nimiq-primitives","ecosystem":"crates.io","purl":"pkg:cargo/nimiq-primitives"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mw3q-r9wh-h2ff/GHSA-mw3q-r9wh-h2ff.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}