Executive brief
Nimiq's Rust implementation of its blockchain networking library is vulnerable to a denial-of-service attack. An attacker can send specially crafted peer information that contains no network addresses, which the system incorrectly accepts. When a user or administrator later attempts to view the address book via the web client or RPC interface, the node will crash, potentially disrupting blockchain operations and service availability.
Technical details
A denial-of-service vulnerability exists in the network-libp2p discovery component of the Nimiq Rust implementation. The PeerContact structure lacks intrinsic validation to ensure the addresses list is non-empty, allowing signed updates from untrusted peers with empty address arrays to be stored in the PeerContactBook. When PeerContactBook::known_peers is subsequently called—typically via an RPC or web client request to get_address_book—the code attempts to access the first element of the address list using .expect(), triggering a Rust panic. Depending on the node's panic settings, this results in a crash of the specific RPC task or the entire node. The issue is fixed in version 1.4.0 by skipping peers with empty address lists during address book construction.
Affected products
- Nimiq nimiq-network-libp2p <= 1.3.0
Timeline
- 2026-04-22: patched: Fix merged in pull request #3715 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-c45m-6x25-3cjq published
- 2026-05-20: disclosed: CVE-2026-40094 published