PT-2026-41387 · Crates.Io · Nimiq-Keys

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-40092

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact

A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from bytes call fails because ed25519 zebra::Signature::try from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics.

Patches

The patch for this vulnerability is formally released as part of v1.4.0.

Workarounds

No known workarounds.

Resources

See PR.

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2026-40092

GHSA-27W2-87XV-37C6

Affected Products

Nimiq-Keys

References · 6

• https://osv.dev/vulnerability/GHSA-27w2-87xv-37c6 · Vendor Advisory
• https://github.com/nimiq/core-rs-albatross · Note
• https://github.com/nimiq/core-rs-albatross/commit/807ee8e99a7ccdc604d49971f292854bfa36754d · Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-27w2-87xv-37c6 · Note
• https://github.com/nimiq/core-rs-albatross/pull/3708 · Note