# CVE-2026-40094: Nimiq nimiq-network-libp2p denial of service via empty PeerContact addresses

Source: https://junglewise.ai/threats/cve-2026-40094-nimiq-nimiq-network-libp2p-denial-of-service-via-empty  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-40094 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Nimiq's Rust implementation of its blockchain networking library is vulnerable to a denial-of-service attack. An attacker can send specially crafted peer information that contains no network addresses, which the system incorrectly accepts. When a user or administrator later attempts to view the address book via the web client or RPC interface, the node will crash, potentially disrupting blockchain operations and service availability.

Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-40094 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40094 being exploited in the wild.

**How severe is CVE-2026-40094?** Medium severity, with a CVSS score of 4.3, published 20 May 2026.

**Which products and versions are affected?** Nimiq nimiq-network-libp2p <= 1.3.0.

**Is there a fix for CVE-2026-40094?** A patch was published on 2026-04-22: Fix merged in pull request #3715 and released in v1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40094 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40094?** Check whether you run Nimiq Network Libp2p. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in the network-libp2p discovery component of the Nimiq Rust implementation. The PeerContact structure lacks intrinsic validation to ensure the addresses list is non-empty, allowing signed updates from untrusted peers with empty address arrays to be stored in the PeerContactBook. When PeerContactBook::known_peers is subsequently called—typically via an RPC or web client request to get_address_book—the code attempts to access the first element of the address list using .expect(), triggering a Rust panic. Depending on the node's panic settings, this results in a crash of the specific RPC task or the entire node. The issue is fixed in version 1.4.0 by skipping peers with empty address lists during address book construction.

## Affected products

- Nimiq nimiq-network-libp2p <= 1.3.0

## Timeline

- 2026-04-22: patched: Fix merged in pull request #3715 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-c45m-6x25-3cjq published
- 2026-05-20: disclosed: CVE-2026-40094 published

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3715](https://github.com/nimiq/core-rs-albatross/pull/3715)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-c45m-6x25-3cjq](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-c45m-6x25-3cjq)