PT-2026-42268 · Unknown · Nimiq-Blockchain

1Seal · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-40094

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions nimiq-blockchain versions prior to 1.4.0

Description In the network-libp2p discovery component, the system accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book. Because there is no validation to ensure the addresses list is not empty, an attacker can insert a signed peer contact with an empty addresses list. When the known peers() function in PeerContactBook attempts to build an address book, it calls addresses.first().expect(), which triggers a panic if the list is empty. Consequently, any call to the 'get address book' endpoint via RPC or web client can cause the node or RPC task to crash.

Recommendations Update to version 1.4.0.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-40094

Affected Products

Nimiq-Blockchain

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40094 · Security Note
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 · Note
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-c45m-6x25-3cjq · Note
• https://github.com/nimiq/core-rs-albatross/pull/3715 · Note
• https://t.me/CVEtracker/54444 · Telegram Post