Message handling vulnerability in Nimiq network implementation by Nimiq

CVE-2026-34062

What is CVE-2026-34062?

The nimiq-libp2p implementation of the Nimiq network has a vulnerability in its message handling functions. Specifically, the MessageCodec::read_request and read_response methods utilize read_to_end() on incoming substreams. This allows a remote peer to send incomplete messages while keeping the substream active, potentially leading to resource exhaustion. The configuration that allows up to 1000 concurrent streams can exacerbate this issue, resulting in a large stalled-slot budget that exceeds safe operational limits. A patch has been officially released in version 1.3.0, and currently, there are no stated workarounds.

References