CVE-2026-33184 nimiq CVE debrief

Who should care

Users of Nimiq Proof-of-Stake protocol, specifically those using versions prior to 1.3.0, should be aware of this vulnerability and take immediate action to patch. Affected operators, platforms, vulnerability-management teams, and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Reviewing compensating controls for exposed systems while remediation is scheduled and verified is also recommended.

Technical summary

The Nimiq Proof-of-Stake protocol, implemented in Rust, has a vulnerability in its discovery handler. During handshake, it accepts a peer-controlled limit and stores it without modification. When the session reaches Established, the periodic update path computes self.peer_list_limit.unwrap() as usize - 1. If the limit is 0, this wraps to usize::MAX, causing rand 0.9.2's choose_multiple() to attempt Vec::with_capacity(amount), which deterministically panics with capacity overflow.

Defensive priority

High priority due to HIGH severity CVSS score of 7.5 and potential for denial of service via panic. Users should take immediate action to patch and review configurations to ensure secure peer limits. Monitoring for potential denial of service attempts is also recommended. The vulnerability has a high impact on the system's availability and should be addressed promptly. Defenders should prioritize patching and review of configurations to prevent potential attacks. The vulnerability's impact on the system's confidentiality and integrity is low, but its availability impact is high. Therefore, defenders should focus on ensuring the system's availability. The Nimiq Proof-of-Stake protocol's vulnerability can be mitigated by applying the patch and reviewing configurations. The vulnerability's CVSS score indicates a high severity, and defenders should take immediate action to address it. The vulnerability's discovery handler accepts a peer-controlled limit during handshake and stores it unchanged, leading to a panic with capacity overflow when the session reaches Established. Defenders should be aware of the vulnerability's impact and take necessary actions to prevent potential attacks. The vulnerability's impact on the system's security posture is significant, and defenders should prioritize its mitigation. The Nimiq Proof-of-Stake protocol's implementation in Rust has a vulnerability that can be exploited to cause a denial of service. Defenders should review the official advisory and CVE record for more information on the vulnerability and its mitigation. The vulnerability's CVSS score is 7.5, indicating a high severity, and defenders should take immediate action to address it. The vulnerability's impact on the system's availability is high, and defenders should prioritize patching and review of configurations to prevent potential attacks. The vulnerability can be mitigated by applying the patch and reviewing configurations to ensure secure peer limits. Monitoring for potential denial of service attempts is also recommended to prevent potential attacks. The vulnerability's discovery handler accepts a peer-controlled limit during handshake and stores it unchanged, 导致当

Recommended defensive actions

• Apply the patch by upgrading to version 1.3.0 or later
• Review and update configurations to ensure secure peer limits
• Monitor for potential denial of service attempts
• Inventory and update affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-04-03T23:17:03.600Z and has been modified. The NVD entry is currently Analyzed. Limited information is available about the vulnerability's impact and affected scope. Evidence is limited, and defenders should verify the vulnerability's impact on their systems. The Nimiq Proof-of-Stake protocol implementation in Rust has a vulnerability in its discovery handler. The vulnerability allows for a panic with capacity overflow when the session reaches Established. Users should review the official advisory and CVE record for more information.

Official resources