CVE-2026-46541: Nimiq network-libp2p: DHT query poisoning via first-record verification failure

Synopsis

A denial-of-service vulnerability exists in the DHT (Distributed Hash Table) query handling logic of Nimiq's core-rs-albatross Rust library, which implements the Nimiq Proof-of-Stake protocol. The flaw is reachable over the network without any authentication: a malicious DHT peer that responds first with a tampered record prevents the result accumulator from being initialized, causing all subsequent valid records to be silently dropped. Successful exploitation disrupts DHT-based peer discovery and data retrieval, effectively denying service to the affected node. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target node over the network by acting as a participating DHT peer that responds to queries.

• AuthenticationNot required

  No credentials or account are needed; any DHT peer can send a malformed record in response to a query.

• Victim interactionNot required

  No user action is required; the vulnerable code path is triggered automatically when the node processes DHT query responses.

• Attack complexityDetail

  Exploit is reliable and condition-free as long as the attacker can position a malicious DHT node to respond before legitimate peers, which is feasible in open peer-to-peer networks.

Blast Radius

• The targeted node's DHT result accumulator is never initialized, causing all valid DHT records from honest peers to be discarded for the duration of the query.
• Peer discovery and DHT-based data retrieval fail with 'DHT inconsistent state' errors, isolating the node from correct network state.
• Repeated poisoning of queries degrades the node's ability to participate in the Nimiq Proof-of-Stake consensus process, disrupting block propagation and validation.