PT-2026-34544 · Unknown · Network-Libp2P

Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-34063

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions network-libp2p versions prior to 1.3.0

Description Discovery in network-libp2p utilizes a libp2p ConnectionHandler state machine that assumes a maximum of one inbound and one outbound discovery substream per connection. If a remote peer negotiates the discovery protocol substream a second time on the same connection, the handler triggers a panic!("Inbound already connected") or panic!("Outbound already connected") path. This results in a crash of the networking task (swarm), which takes the node's p2p networking offline until a restart occurs.

Recommendations Update to version 1.3.0.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2026-34063

Affected Products

Network-Libp2P

References · 7

• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-74hp-mhfx-m45h · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross/pull/3666 · Patch
• https://github.com/nimiq/core-rs-albatross/commit/e0d4e01994f061bf41d3c2835bc74040d3c084f5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34063 · Security Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0 · Note
• https://twitter.com/CVEnew/status/2047359959189324021 · Twitter Post
• https://twitter.com/infoflowcloud/status/2047361928914248175 · Twitter Post