CVE-2026-40094
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In the nimiq-blockchain library (versions 1.3.0 and prior), network discovery accepts signed PeerContact updates from untrusted peers and stores them in the contact book, potentially causing an address book crash. An attacker can send a contact with an empty address list, causing a panic when accessing the address book.
Risk Assessment
An attacker can crash the node or RPC task, leading to denial of service.
Recommendation
Update nimiq-blockchain to version 1.4.0 or later, which contains a fix.
Other vulnerabilities in nimiq-blockchain
See all- CVE-2026-40092High
nimiq-blockchain prior to version 1.4.0 has a vulnerability where a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The record contains a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64, causing a panic when unwrap() is called in the Ed25519 implementation. The BLS implementation correctly returns false, but Ed25519 panics.
- CVE-2026-34066Medium
In nimiq-blockchain before version 1.3.0, HistoryStore::put_historic_txns uses an assert! to enforce invariants about HistoricTransaction.block_number. During history sync, a peer can influence the input passed to Blockchain::push_history_sync, and a malformed history list can violate these invariants and trigger a panic before later rejection checks run.
Original NVD description (English source)
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect("every peer should have at least one address"). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS