rustsec-2026-0232
Vulnerability from osv_rustsec
The processed events received from a relay through admission-policy and database paths before verifying that the serialized fields matched the claimed event ID and signature. In particular, a database result for the claimed ID could cause verification to be skipped. The verification cache also keyed successful checks by a 64-bit hash instead of the complete event ID.
A malicious relay could send an event whose claimed ID referred to a known database entry while its content, tags, author, or signature differed from that ID. The forged event could then reach policy callbacks or other SDK processing as if it were authentic. A cache-key collision provided a second path for an unverified event to be treated as previously verified. This undermines event integrity but does not reveal private keys or enable the attacker to produce a valid signature for the altered event.
The SDK now verifies each event before policy evaluation, database lookup, or
propagation decisions, and the verification cache stores the complete EventId so a
truncated hash collision cannot stand in for successful verification.
{
"affected": [
{
"database_specific": {
"categories": [
"crypto-failure"
],
"cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"informational": null
},
"ecosystem_specific": {
"affected_functions": null,
"affects": {
"arch": [],
"functions": [],
"os": []
}
},
"package": {
"ecosystem": "crates.io",
"name": "nostr-relay-pool",
"purl": "pkg:cargo/nostr-relay-pool"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-0"
},
{
"fixed": "0.44.3"
}
],
"type": "SEMVER"
}
],
"versions": []
}
],
"aliases": [],
"database_specific": {
"license": "CC0-1.0"
},
"details": "The processed events received from a relay through admission-policy and database\npaths before verifying that the serialized fields matched the claimed event ID and\nsignature. In particular, a database result for the claimed ID could cause\nverification to be skipped. The verification cache also keyed successful checks by a\n64-bit hash instead of the complete event ID.\n\nA malicious relay could send an event whose claimed ID referred to a known database\nentry while its content, tags, author, or signature differed from that ID. The forged\nevent could then reach policy callbacks or other SDK processing as if it were\nauthentic. A cache-key collision provided a second path for an unverified event to be\ntreated as previously verified. This undermines event integrity but does not reveal\nprivate keys or enable the attacker to produce a valid signature for the altered\nevent.\n\nThe SDK now verifies each event before policy evaluation, database lookup, or\npropagation decisions, and the verification cache stores the complete `EventId` so a\ntruncated hash collision cannot stand in for successful verification.",
"id": "RUSTSEC-2026-0232",
"modified": "2026-08-02T17:56:20Z",
"published": "2026-08-01T12:00:00Z",
"references": [
{
"type": "PACKAGE",
"url": "https://crates.io/crates/nostr-relay-pool"
},
{
"type": "ADVISORY",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0232.html"
},
{
"type": "WEB",
"url": "https://github.com/nostrdevkit/nostr/commit/4b67f9b45909d2e35f34c30c084c0ab66e599a9f"
}
],
"related": [],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Processing of unverified relay events"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.