CVE-2026-44505: Nimiq network-libp2p DHT Query Indefinite Hang Vulnerability

Technical summary

CVE-2026-44505 is a resource exhaustion vulnerability in Nimiq's network-libp2p DHT handler. The handle_dht_get function in network-libp2p/src/swarm.rs fails to complete oneshot channels and clean up per-query bookkeeping when record verification fails via dht_verifier.verify(). Additionally, the DHT inconsistent state code path also returns without proper cleanup. Because Network::dht_get awaits the oneshot indefinitely without timeout logic, callers can block permanently. The underlying issue is rooted in incomplete error handling that violates the cleanup contract expected by the async runtime.

Business impact

Availability is the primary concern. An attacker controlling or influencing peers in the DHT can craft responses that trigger verification failures, causing legitimate peers to exhaust connection slots and internal query tracking resources. Over time, this can degrade or halt DHT operations, affecting consensus participation and network communication for Nimiq validator and full nodes. For staking operations or time-sensitive transactions, this denial-of-service condition creates operational risk.

Affected systems

Nimiq implementations using network-libp2p versions prior to 1.4.0 are affected. This includes both validator and full node deployments that rely on DHT queries for peer discovery, record lookup, and consensus operations. The vulnerability is specific to the Rust Nimiq implementation and the Albatross consensus protocol stack.

Exploitability

Exploitation requires the ability to become or influence a peer in the DHT network and respond to get-record queries. The attack vector is network-based with no authentication or privilege requirements. An attacker does not need to compromise a specific node; participation in the DHT as a malicious peer is sufficient. The CVSS 3.1 score of 5.3 (MEDIUM, AV:N/AC:L) reflects low complexity and no preconditions, but impact is limited to availability. Real-world feasibility depends on the attacker's ability to attract or route queries to their controlled peer nodes.

Remediation

Upgrade Nimiq and network-libp2p to version 1.4.0 or later. This release includes proper cleanup of oneshot channels and per-query bookkeeping on all error paths, including verification failures and DHT inconsistent state conditions. Verify the patch has been applied by checking dependency versions in your Cargo.lock or equivalent dependency manifest.

Patch guidance

Update network-libp2p to version 1.4.0 or newer. If Nimiq is distributed as a monolithic package, verify the release notes confirm inclusion of the network-libp2p patch. Test the update in a non-production environment to ensure DHT operations and consensus participation function correctly. Monitor peer connection metrics and DHT query latencies during and after rollout to detect any unexpected behavior.

Detection guidance

Monitor Nimiq logs for repeated 'DHT inconsistent state' messages or verification errors on the same peer addresses, which may indicate malicious peers. Track the number of pending DHT queries and oneshot channels—abnormal accumulation suggests hung queries. Watch for elevated memory usage correlated with DHT activity. Network-level detection is difficult without deep packet inspection; focus on behavioral indicators such as consensus stalls, missing block proposals, or timeouts in validator operations after DHT interactions.

Why prioritize this

Although scored MEDIUM severity, this vulnerability poses meaningful risk to Nimiq's consensus layer because it can disable DHT-dependent discovery and record lookup. Validator nodes that become unable to query the DHT may fall out of sync or fail to participate in consensus rounds. The ease of exploitation (network-based, low complexity, no privileges) and the indefinite hang condition (not a brief timeout) elevate operational priority. Patch deployment should precede any high-stakes consensus events or major network upgrades.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with low attack complexity and no authentication, but limited impact scope. Confidentiality and integrity are unaffected; only availability is compromised. The score does not account for context-specific risks in blockchain or consensus protocols, where availability directly impacts liveness and finality. Organizations running Nimiq validators should treat this as higher priority than the base score alone suggests.

Frequently asked questions