Denial of Service Vulnerability in Nimiq Proof-of-Stake Protocol by Nimiq

CVE-2025-47270

What is CVE-2025-47270?

The Nimiq core-rs-albatross library is exposed to a Denial of Service attack due to improper memory allocation in its Discovery message handling. By sending a specially crafted message, an attacker can exploit this vulnerability to trigger allocations of up to 4 GB of memory, leading to significant resource exhaustion and potential node crashes. This issue arises because the implementation does not enforce an upper limit on the length of the buffer that is allocated based on peer input. The vulnerability can be repeatedly exploited, given that Discovery messages are a routine part of the peer discovery process. Users are advised to upgrade to the patched version 1.1.0, where a 1 MB limit has been imposed on discovery message sizes. There are currently no known workarounds for this issue.

References