PT-2026-41387 · Nimiq · Nimiq-Blockchain

Piravlos · Published 2026-05-15 · Updated 2026-05-20 · CVE-2026-40092

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions nimiq-blockchain versions prior to 1.4.0

Description A malicious network peer can crash a Nimiq full node by publishing a crafted Kademlia DHT record. The record contains a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64. When the node's DHT verifier calls the TaggedSigned::verify function, execution reaches Ed25519Signature::from bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from bytes call fails because ed25519 zebra::Signature::try from rejects slices that are not 64 bytes, causing the unwrap() function to panic and crash the node. This issue specifically affects the Ed25519 implementation, whereas the BLS TaggedPublicKey implementation correctly handles the error.

Recommendations Update to version 1.4.0.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2026-40092

GHSA-27W2-87XV-37C6

Affected Products

Nimiq-Blockchain

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-40092 · Security Note
• https://osv.dev/vulnerability/GHSA-27w2-87xv-37c6 · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 · Note
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-27w2-87xv-37c6 · Note
• https://github.com/nimiq/core-rs-albatross/commit/807ee8e99a7ccdc604d49971f292854bfa36754d · Note
• https://github.com/nimiq/core-rs-albatross/pull/3708 · Note
• https://t.me/CVEtracker/54443 · Telegram Post