CVE-2026-32605

OVERVIEW CVE-2026-32605 is a denial-of-service vulnerability in nimiq/core-rs-albatross, a Rust-based Proof-of-Stake blockchain implementation using the Albatross consensus algorithm. An untrusted peer can crash validator nodes by sending a specially crafted Tendermint proposal message with an out-of-bounds signer index. The flaw stems from improper bounds validation in the ProposalSender::send function, which fails to prevent access to invalid validator array indices prior to cryptographic verification. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no privileges or user interaction. The attack complexity is low, making it easily exploitable by any network participant. The impact is limited to availability, as successful exploitation causes an unhandled panic that crashes the validator process without affecting confidentiality or integrity. The FAUCET risk score of 48.0/100 indicates moderate concern relative to broader vulnerability landscapes. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from CISA's Known Exploited Vulnerabilities catalog and inactive status on exploit tracking lists. The extremely low EPSS score of 0.00055 suggests minimal real-world exploitation likelihood. The vulnerability was patched in version 1.3.0, and community awareness appears limited given the specialized nature of the affected software. Organizations running nimiq/core-rs-albatross should prioritize upgrading to the patched version.