# CVE-2026-44505: Nimiq core-rs-albatross denial of service in DHT record handling

Source: https://junglewise.ai/threats/cve-2026-44505-nimiq-core-rs-albatross-denial-of-service-in-dht-record-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-44505 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Nimiq is a blockchain protocol that uses a distributed network to store and retrieve data. A flaw in how the software handles responses from other participants allows a malicious or malfunctioning peer to send invalid data that causes the Nimiq node to hang indefinitely. This can lead to a denial-of-service condition where the node stops responding to data requests, potentially disrupting blockchain operations and network synchronization.

Technologies: [Nimiq Albatross](https://junglewise.ai/threats/technologies/albatross). Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-44505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44505 being exploited in the wild.

**How severe is CVE-2026-44505?** Medium severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** Nimiq Albatross <= 1.3.0.

**Is there a fix for CVE-2026-44505?** A patch was published on 2026-04-22: Fix merged in pull request #3716 and released in v1.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44505?** Check whether you run Nimiq Albatross at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the `handle_dht_get` function within `network-libp2p/src/swarm.rs` of the Nimiq Rust implementation. When a peer returns a `FoundRecord`, the system performs a verification check; if this check fails, the code returns early without completing the internal 'oneshot' channel or cleaning up query bookkeeping. Because the `Network::dht_get` function awaits this channel without a timeout, the calling future remains in a permanent pending state (a 'wedge'). An attacker can exploit this by providing malformed or invalid DHT records, leading to resource exhaustion or service unavailability. This issue is addressed in version 1.4.0 by introducing proper error variants and an `abort_dht_get()` function to ensure state cleanup.

## Affected products

- Nimiq core-rs-albatross <= 1.3.0

## Timeline

- 2026-04-22: patched: Fix merged in pull request #3716 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory GHSA-g39c-jcgg-qwvr published
- 2026-06-10: disclosed: CVE-2026-44505 published to NVD

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3716](https://github.com/nimiq/core-rs-albatross/pull/3716)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g39c-jcgg-qwvr](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-g39c-jcgg-qwvr)

## Related threats

- [Nimiq Albatross denial of service in MerkleRadixTrie synchronization](https://junglewise.ai/threats/cve-2026-46545-nimiq-albatross-denial-of-service-in-merkleradixtrie)
- [Nimiq core-rs-albatross DHT query poisoning in handle_dht_get](https://junglewise.ai/threats/cve-2026-46541-nimiq-core-rs-albatross-dht-query-poisoning-in-handle-dht-get)
- [Nimiq Albatross state synchronization failure in LightBlockchain rebranch](https://junglewise.ai/threats/cve-2026-46540-nimiq-albatross-state-synchronization-failure-in-lightblockchain)
- [Nimiq core-rs-albatross denial of service via history index panic](https://junglewise.ai/threats/cve-2026-35468-nimiq-core-rs-albatross-denial-of-service-via-history-index-panic)
- [Nimiq core-rs-albatross interlink verification bypass in election macro blocks](https://junglewise.ai/threats/cve-2026-34061-nimiq-core-rs-albatross-interlink-verification-bypass-in-election)