PT-2026-34543 · Nimiq · Nimiq-Libp2P

CVE-2026-34062 · Published 2026-04-22 · Updated 2026-04-23

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions nimiq-libp2p versions prior to 1.3.0

Description In this Nimiq network implementation based on libp2p, the functions MessageCodec::read request() and read response() call read to end() on inbound substreams. This allows a remote peer to send a partial frame and keep the substream open. Additionally, because Behaviour::new sets with max concurrent streams(1000), the node exposes a larger stalled-slot budget than the library default.

Recommendations Update to version 1.3.0.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-34062

GHSA-GH7R-QH4P-Q4FR

Affected Products

Nimiq-Libp2P

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34062.json · Exploit
• https://github.com/nimiq/core-rs-albatross/commit/c021a5337b808c73571b44999f9753051bac7508 · Patch
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gh7r-qh4p-q4fr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34062 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34062 · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://twitter.com/infoflowcloud/status/2047361975965946277 · Twitter Post
• https://twitter.com/CVEnew/status/2047359962574139793 · Twitter Post