CVE-2025-47270
HighSummary
Podatność w subkrasie `nimiq-network-libp2p` w projekcie nimiq/core-rs-albatross umożliwia atak typu Denial of Service (DoS) z powodu niekontrolowanej alokacji pamięci. W szczególności, obsługa wiadomości sieciowych `Discovery` nie narzuca górnego limitu na długość bufora, co pozwala na alokację do 4 GB pamięci.
Risk Assessment
Wykorzystanie tej podatności może prowadzić do wyczerpania pamięci i awarii węzłów, co wpływa na dostępność całej sieci. Regularna wymiana wiadomości Discovery sprawia, że atak może być przeprowadzany wielokrotnie.
Recommendation
Zaleca się aktualizację do wersji v1.1.0, która wprowadza limit rozmiaru wiadomości Discovery do 1 MB oraz dostosowuje rozmiar bufora wiadomości podczas odczytu danych. Brak znanych obejść tej podatności.
Related vulnerabilities
- CVE-2026-86102Critical
An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
- CVE-2026-101894Critical
The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.
- CVE-2026-101891Critical
An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
- CVE-2026-101081Critical
A stack-based buffer overflow vulnerability has been discovered in D-Link DI-8400 version 16.07 in the function menu_nat_more_asp of the file menu_nat_more.asp (Web Administration Service component). Manipulation of the argument opt allows remote attack. The exploit is public.
- CVE-2026-88804Critical
In SUSE Rancher (versions 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14, and 2.11 before 2.11.18), an unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting (XSS) attack in the Rancher UI.
- CVE-2026-12342Critical
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
- CVE-2026-101077Critical
A missing authentication vulnerability has been found in Netcore NR289-GE version 1.4.5102 in the function process_request of the boa_temp Handler component. The attack can be carried out remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-101076Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /set_ntp_server_ip.cgi (CGI Handler component). Manipulation of the argument ntp_ip allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101075Critical
An OS command injection vulnerability has been detected in Netcore NR289-GE version 1.4.5102 in the system function of the file /location_time.cgi (Location Time Handler component). Manipulation of the argument mac allows remote command execution. The exploit is public, and the vendor did not respond.
- CVE-2026-101074Critical
A stack-based buffer overflow vulnerability has been identified in Netcore NR289-GE version 1.4.5102 in the password-check function of the file /bin/boa (Authentication component). Manipulation of the argument Username allows remote attack. The exploit is public, and the vendor did not respond.
Original NVD description (English source)
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service (DoS) attack due to uncontrolled memory allocation. Specifically, the implementation of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enforcing an upper bound. Since this length is a `u32`, a peer can trigger allocations of up to 4 GB, potentially leading to memory exhaustion and node crashes. As Discovery messages are regularly exchanged for peer discovery, this vulnerability can be exploited repeatedly. The patch for this vulnerability is formally released as part of v1.1.0. The patch implements a limit to the discovery message size of 1 MB and also resizes the message buffer size incrementally as the data is read. No known workarounds are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS