Read the docs
TI-2026-34220 Aliases CVE-2026-46541

Nimiq network-libp2p: DHT query poisoning via first-record verification failure

Priority LOW 39CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsistent state" errors. This issue has been patched in version 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed core-rs-albatross (nimiq): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nimiqcore-rs-albatrossbefore 1.4.01.4.0Patch availableCNA
  • core-rs-albatross Vendornimiq Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:*——nimiq
  • cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:* Versions — — ·nimiq

Remediation

  • Fix · CNA core-rs-albatross (nimiq) Fixed in 1.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46541
  2. 2026-10-25 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-26389 nimiq-account: Vesting insufficient funds error can panic CVSS 3.1HIGH 8.2
  • TI-2026-25867 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation CVSS 3.1CRITICAL 9.6
  • TI-2026-34086 Nimiq: Validity store off by one error CVSS 3.1HIGH 7.5
  • TI-2026-28920 nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT CVSS 3.1HIGH 7.5
  • TI-2025-29800 nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-34224 nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item CVSS 3.1HIGH 7.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences