Block Storage Vulnerability in Nimiq's Rust Implementation

CVE-2026-40094

What is CVE-2026-40094?

The nimiq-blockchain, which provides persistent block storage for Nimiq's Rust implementation, contains a vulnerability that affects its ability to handle peer contact updates. In versions prior to 1.4.0, the network-libp2p discovery system can accept signed PeerContact updates from untrusted sources without adequate validation. This flaw allows an attacker to insert a malicious PeerContact that contains an empty list of addresses. When the address book is constructed using this faulty entry, it can lead to a crash of the node or RPC task if the system attempts to access these empty addresses. The issue has been resolved in version 1.4.0, emphasizing the importance of keeping software updated to mitigate such risks.

References