FKIE_CVE-2026-40092
Vulnerability from fkie_nvd - Published: 2026-05-20 22:16 - Updated: 2026-07-23 15:10
Severity
Summary
nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "core-rs-albatross",
"vendor": "nimiq",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "nimiq-blockchain provides persistent block storage for Nimiq\u0027s Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned\u003cValidatorRecord, KeyPair\u003e with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node\u0027s DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0."
},
{
"lang": "es",
"value": "nimiq-blockchain proporciona almacenamiento persistente de bloques para la implementaci\u00f3n en Rust de Nimiq. En las versiones 1.3.0 e inferiores, un par de red malicioso puede colapsar cualquier nodo completo de Nimiq publicando un registro DHT de Kademlia manipulado. El registro manipulado maliciosamente contendr\u00eda un TaggedSigned\u003cValidatorRecord, KeyPair\u003e con un campo de firma cuya longitud en bytes no es exactamente 64 para causar un colapso. Cuando el verificador DHT del nodo v\u00edctima llama a TaggedSigned::verify, la ejecuci\u00f3n llega a Ed25519Signature::from_bytes(sig).unwrap() en la implementaci\u00f3n de TaggedPublicKey para Ed25519PublicKey. La llamada a from_bytes falla porque ed25519_zebra::Signature::try_from rechaza segmentos que no tienen 64 bytes, y el unwrap() entra en p\u00e1nico. La implementaci\u00f3n BLS de TaggedPublicKey devuelve correctamente \u0027false\u0027 en caso de error; solo la implementaci\u00f3n de Ed25519 entra en p\u00e1nico. Este problema ha sido solucionado en la versi\u00f3n 1.4.0."
}
],
"id": "CVE-2026-40092",
"lastModified": "2026-07-23T15:10:00.137",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-40092",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-21T12:23:05.311120Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-20T22:16:36.850",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/nimiq/core-rs-albatross/commit/807ee8e99a7ccdc604d49971f292854bfa36754d"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/nimiq/core-rs-albatross/pull/3708"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-27w2-87xv-37c6"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-252"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…