Read the docs
TI-2025-29800 Aliases CVE-2025-47270

nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` subcrate of nimiq/core-rs-albatross is vulnerable to a Denial of Service (DoS) attack due to uncontrolled memory allocation. Specifically, the implementation of the `Discovery` network message handling allocates a buffer based on a length value provided by the peer, without enforcing an upper bound. Since this length is a `u32`, a peer can trigger allocations of up to 4 GB, potentially leading to memory exhaustion and node crashes. As Discovery messages are regularly exchanged for peer discovery, this vulnerability can be exploited repeatedly. The patch for this vulnerability is formally released as part of v1.1.0. The patch implements a limit to the discovery message size of 1 MB and also resizes the message buffer size incrementally as the data is read. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00742 54th percentileScored 2026-11-07
Fix Fixed core-rs-albatross (nimiq): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nimiqcore-rs-albatrossbefore 1.1.01.1.0Patch availableCNA
  • core-rs-albatross Vendornimiq Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:*——nimiq
  • cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:* Versions — — ·nimiq

Remediation

  • Fix · CNA core-rs-albatross (nimiq) Fixed in 1.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47270

References

Other 4

  • TI-2026-26389 nimiq-account: Vesting insufficient funds error can panic CVSS 3.1HIGH 8.2
  • TI-2026-25867 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation CVSS 3.1CRITICAL 9.6
  • TI-2026-34086 Nimiq: Validity store off by one error CVSS 3.1HIGH 7.5
  • TI-2026-28920 nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT CVSS 3.1HIGH 7.5
  • TI-2026-34224 nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item CVSS 3.1HIGH 7.5
  • TI-2026-34220 Nimiq network-libp2p: DHT query poisoning via first-record verification failure CVSS 3.1HIGH 7.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences