GHSA-46WQ-28CX-MHW4 nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted TrieChunk whose proof contains two TrieProofNodes with identical keys. TrieProof::verify calls TrieProofNode::childindex primitives/src/trie/trieproofnode.rs:94, which unconditionally unwraps...

PT-2026-60695

Name of the Vulnerable Software and Affected Versions core-rs-albatross versions prior to 1.6.0 Description A malicious state-sync peer can cause a syncing node to crash by sending a crafted TrieChunk proof containing two TrieProofNode values with identical keys. The issue occurs when...