Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service caused by an uncaught panic in the nimiq-primitives library. The root cause is insufficient validation of input from remote peers during the state synchronization process. A malicious peer can send a TrieChunk containing an item with an empty (ROOT) key. The MerkleRadixTrie::put_chunk function, which is the entry point for processing these chunks, did not validate for this specific case and would proceed to process the malicious data. It then calls MerkleRadixTrie::put_raw, which in turn attempts to store a value at the trie's root. This is an invalid operation, and the put_value method returns an error. However, the code unwraps the result of this operation, leading to a panic that crashes the entire node process. The fix involves adding a check at the beginning of put_chunk to reject any chunk where the first item's key is empty, thus preventing the malicious data from reaching the code path that would trigger the panic.
MerkleRadixTrie::put_chunkprimitives/trie/src/trie.rs
MerkleRadixTrie::put_rawprimitives/trie/src/trie.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nimiq-primitives | rust | < 1.5.0 | 1.5.0 |