# CVE-2026-46541: Nimiq core-rs-albatross DHT query poisoning in handle_dht_get

Source: https://junglewise.ai/threats/cve-2026-46541-nimiq-core-rs-albatross-dht-query-poisoning-in-handle-dht-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46541 · Severity: high · CVSS 7.5 · Published 2026-06-10

Nimiq is a blockchain protocol using a Rust-based implementation. A flaw in how the system handles data from its distributed network allows a malicious participant to block legitimate data from being processed. This can lead to a denial-of-service condition where the node fails to synchronize or retrieve necessary records, potentially disrupting blockchain operations.

Technologies: [Nimiq Albatross](https://junglewise.ai/threats/technologies/albatross). Vendors: [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-46541 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46541 being exploited in the wild.

**How severe is CVE-2026-46541?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** Nimiq Albatross <= 1.3.0.

**Is there a fix for CVE-2026-46541?** A patch was published on 2026-04-22: Version 1.4.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46541 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46541?** Check whether you run Nimiq Albatross at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the handle_dht_get() function of Nimiq's Rust implementation. The DhtResults accumulator is only initialized upon the successful verification of the first received DHT record. If an attacker-controlled DHT node provides an invalid first record, the accumulator is never created. Consequently, all subsequent valid records from legitimate nodes are discarded with 'DHT inconsistent state' errors. This allows a remote, unauthenticated attacker to poison DHT queries and cause a denial-of-service (DoS) for network lookups. The issue is addressed in version 1.4.0 by ensuring proper initialization of the results accumulator.

## Affected products

- Nimiq core-rs-albatross (Nimiq Rust implementation) <= 1.3.0

## Timeline

- 2026-04-22: patched: Version 1.4.0 released
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3707](https://github.com/nimiq/core-rs-albatross/pull/3707)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-ccqv-2c9q-mqw5](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-ccqv-2c9q-mqw5)

## Related threats

- [Nimiq Albatross denial of service in MerkleRadixTrie synchronization](https://junglewise.ai/threats/cve-2026-46545-nimiq-albatross-denial-of-service-in-merkleradixtrie)
- [Nimiq Albatross state synchronization failure in LightBlockchain rebranch](https://junglewise.ai/threats/cve-2026-46540-nimiq-albatross-state-synchronization-failure-in-lightblockchain)
- [Nimiq core-rs-albatross denial of service in DHT record handling](https://junglewise.ai/threats/cve-2026-44505-nimiq-core-rs-albatross-denial-of-service-in-dht-record-handling)
- [Nimiq core-rs-albatross denial of service via history index panic](https://junglewise.ai/threats/cve-2026-35468-nimiq-core-rs-albatross-denial-of-service-via-history-index-panic)
- [Nimiq core-rs-albatross interlink verification bypass in election macro blocks](https://junglewise.ai/threats/cve-2026-34061-nimiq-core-rs-albatross-interlink-verification-bypass-in-election)