CVE-2026-40094: Nimiq nimiq-network-libp2p denial of service via empty PeerContact addresses

CVE-2026-40094 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Nimiq's Rust implementation of its blockchain networking library is vulnerable to a denial-of-service attack. An attacker can send specially crafted peer information that contains no network addresses, which the system incorrectly accepts. When a user or administrator later attempts to view the address book via the web client or RPC interface, the node will crash, potentially disrupting blockchain operations and service availability.

Vendors: Nimiq.

Quick answers

Is CVE-2026-40094 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40094 being exploited in the wild.
How severe is CVE-2026-40094?
Medium severity, with a CVSS score of 4.3, published 20 May 2026.
Which products and versions are affected?
Nimiq nimiq-network-libp2p <= 1.3.0.
Is there a fix for CVE-2026-40094?
A patch was published on 2026-04-22: Fix merged in pull request #3715 and released in v1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40094 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40094?
Check whether you run Nimiq Network Libp2p. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service vulnerability exists in the network-libp2p discovery component of the Nimiq Rust implementation. The PeerContact structure lacks intrinsic validation to ensure the addresses list is non-empty, allowing signed updates from untrusted peers with empty address arrays to be stored in the PeerContactBook. When PeerContactBook::known_peers is subsequently called—typically via an RPC or web client request to get_address_book—the code attempts to access the first element of the address list using .expect(), triggering a Rust panic. Depending on the node's panic settings, this results in a crash of the specific RPC task or the entire node. The issue is fixed in version 1.4.0 by skipping peers with empty address lists during address book construction.

Affected products

  • Nimiq nimiq-network-libp2p <= 1.3.0

Timeline

  • 2026-04-22: patched: Fix merged in pull request #3715 and released in v1.4.0
  • 2026-05-15: advisory: GitHub Security Advisory GHSA-c45m-6x25-3cjq published
  • 2026-05-20: disclosed: CVE-2026-40094 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.