CVE-2026-40092 Details
Description
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.
A denial-of-service vulnerability has been identified in the Nimiq Blockchain Rust implementation, specifically in versions through 1.3.0. The issue arises when a malicious network peer publishes a crafted Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with an improperly sized signature. This malformed record causes the victim node to crash when the DHT verifier attempts to validate the signature, leading to a panic. The vulnerability has been patched in version 1.4.0.
Users can upgrade to Nimiq Blockchain version 1.4.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 20, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nimiq/core-rs-albatross/commit/807ee8e99a7ccdc604d49971f292854bfa36754d | [email protected] | Source CodeVendor |
| https://github.com/nimiq/core-rs-albatross/pull/3708 | [email protected] | Source CodeVendor |
| https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-27w2-87xv-37c6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-252 | Unchecked Return Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nimiq-blockchain | <= 1.3.0 (semver) |
CPE
Remediation
| |
| Nimiq core-rs-albatross | All versions |
CPE
Remediation
| |
| nimiq-keys | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | New CVE Received | [email protected] |