Executive brief
A vulnerability in the Nimiq blockchain's key handling library allows a malicious user to crash any full node on the network. By sending a specially crafted record through the network's peer-to-peer discovery system, an attacker can cause the software to stop responding. This can lead to a complete service outage for affected nodes, disrupting the stability of the blockchain network.
Technical details
A denial-of-service vulnerability exists in the `nimiq-keys` crate due to an unchecked return value when processing Ed25519 signatures. Specifically, the `TaggedPublicKey` implementation for `Ed25519PublicKey` calls `unwrap()` on the result of `Ed25519Signature::from_bytes(sig)`. If a malicious peer publishes a Kademlia DHT record containing a signature that is not exactly 64 bytes, the `try_from` call in the underlying `ed25519_zebra` library fails, causing the `unwrap()` to trigger a thread panic. This allows an unauthenticated remote attacker to crash any Nimiq full node that attempts to verify the crafted DHT record. The issue is fixed in version 1.4.0 of the core-rs-albatross repository.
Affected products
- Nimiq nimiq-keys <= 0.2.0
Timeline
- 2026-05-15: disclosed
- 2026-05-15: advisory
- 2026-05-15: patched: Patched in v1.4.0 of core-rs-albatross