CVE-2026-46541CWE-754

Nimiq network-libp2p: DHT query poisoning via first-record verification failure

High · published June 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsistent state" errors. This issue has been patched in version 1.4.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00609 · 48.5th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-06-09T23:45Z
EPSS history
Timeline
  • 09 JUN 23:45Z
    Nimiq network-libp2p: DHT query poisoning via first-record verification failure
    cvelistv5