CVE-2026-46545: Nimiq State Sync Denial-of-Service Vulnerability (CVSS 7.5)

Technical summary

CVE-2026-46545 is a remote denial-of-service vulnerability in the MerkleRadixTrie::put_chunk function within Nimiq's state synchronization logic. The vulnerability allows unauthenticated network peers to cause unhandled exceptions or resource exhaustion in nodes performing state sync operations. The root cause relates to insufficient validation or error handling (CWE-248: Uncaught Exception) when processing merkle trie chunk data during the synchronization protocol. Attackers need only network access to the vulnerable node and no prior authentication or special privileges. The CVSS 3.1 score of 7.5 reflects high availability impact with low attack complexity.

Business impact

For organizations running Nimiq nodes, this vulnerability creates operational risk during critical node lifecycle events. Newly deployed nodes cannot reliably complete state synchronization—a core bootstrapping requirement—making network participation unpredictable. Node recovery scenarios are similarly compromised, extending outage windows and complicating disaster recovery procedures. If multiple nodes in a validator set or infrastructure deployment are affected simultaneously, network participation and consensus contribution become unreliable, potentially impacting service availability and stake distribution.

Affected systems

All Nimiq implementations prior to version 1.5.0 are affected. This includes nodes running the Albatross consensus algorithm-based Proof-of-Stake protocol. The vulnerability specifically impacts nodes in active state synchronization: freshly joined nodes bootstrapping from genesis or a checkpoint, and recovering nodes re-syncing after downtime or network partitions. Nodes that have already completed state synchronization and are operating in steady state may not be immediately exploitable via this vector, though network-wide attacks could target multiple nodes simultaneously during any sync phase.

Exploitability

This vulnerability is trivial to exploit and requires no specialized privileges or credentials. Any network peer with connectivity to a vulnerable node can send a crafted state sync chunk that triggers the crash. The attack surface is broad because state synchronization is a normal, expected operation for nodes joining or recovering on the Nimiq network. An attacker need only craft a malicious merkle trie chunk and send it during the state sync protocol handshake—low technical barrier. The lack of authentication or complexity in the consensus protocol itself means an attacker can perform reconnaissance and identify vulnerable nodes passively before launching attacks.

Remediation

Upgrade all Nimiq nodes to version 1.5.0 or later. This release includes fixes to the MerkleRadixTrie::put_chunk function to properly validate and handle malformed or unexpected chunk data. Organizations should prioritize upgrading nodes that are frequently performing state synchronization (such as those in test environments, recovering deployments, or running lightweight/validator infrastructure). Verify that upgrades complete successfully and that nodes can complete state synchronization without interruption before returning them to production consensus participation.

Patch guidance

Obtain version 1.5.0 or later from the official Nimiq repository or release channels. Review the release notes to confirm the fix addresses CVE-2026-46545 and any related state-sync robustness improvements. Before deploying to production validators or critical nodes, test the upgrade in a staging environment where you can trigger state synchronization and confirm smooth operation. Plan upgrades during low-load periods or outside critical consensus windows if possible. Nodes do not require data migration or configuration changes—the upgrade is straightforward. Verify node connectivity and state synchronization completion after upgrade; monitor logs for any sync-related errors.

Detection guidance

Monitor for nodes experiencing unexpected crashes or panics during state synchronization phases, particularly correlated with new node deployments or recovery operations. Log analysis should flag any MerkleRadixTrie or state-sync panic messages. Network-level detection is challenging without deep protocol inspection, but you can monitor for peers sending unusual state sync requests or chunks to your nodes and cross-reference with known peer reputations. Implement alerting for nodes that repeatedly fail to complete state synchronization within expected timeframes, as this may indicate active exploitation attempts. Temporary mitigation includes restricting state-sync peer connections to whitelisted, trusted peers if feasible, though this reduces network resilience.

Why prioritize this

This vulnerability warrants prompt remediation despite not being on the KEV catalog. The combination of remote exploitability, no authentication required, high attack surface (all state-syncing nodes), and direct availability impact make it a clear operational risk. The attack is trivial to execute and could be weaponized at scale to disrupt network participation or target specific validator infrastructure. Nodes cannot safely perform state synchronization until patched, directly blocking normal lifecycle operations. High CVSS score and practical exploitability justify treating this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity requiring no special conditions (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), and high impact to availability (A:H). Confidentiality and integrity are not affected (C:N/I:N). The score appropriately captures the operational threat to node availability during state synchronization without overweighting attack complexity, which is minimal for a network-based DoS.

Frequently asked questions