CVE-2026-46541: Nimiq DHT Poisoning Denial-of-Service Vulnerability

Technical summary

The vulnerability exists in the handle_dht_get() function prior to version 1.4.0. The DhtResults accumulator initialization is gated behind successful verification of the first DHT record received. If a malicious peer sends a record that fails cryptographic verification, the accumulator remains uninitialized. Subsequent valid records from honest peers are then rejected because the code path expects an initialized accumulator; the absence triggers "DHT inconsistent state" error handling that discards the data. This is a logic flaw in initialization sequencing (CWE-754: Improper Resource Validation) that prevents normal DHT synchronization and state recovery. The vulnerability is network-exploitable with no authentication barrier.

Business impact

For organizations or validators running Nimiq nodes, this flaw can cause network partitioning and data synchronization failure. Validators may be unable to retrieve critical state information from the DHT, potentially leading to chain sync delays, missed block proposals, or inability to participate in consensus. Staking rewards and network participation are at risk. For exchanges, custodians, or infrastructure operators, degraded DHT performance translates to reduced availability and operational complexity during incident response.

Affected systems

Nimiq implementations prior to version 1.4.0 are affected. This includes any Nimiq node, validator, or client software running pre-1.4.0 releases. The vulnerability is specific to the Albatross consensus implementation and does not affect other blockchain systems. Affected parties should verify their running version via standard Nimiq tooling (e.g., --version flag or RPC queries).

Exploitability

Exploitation is straightforward: an attacker positioned on the network can send a single invalid DHT record to a target node. No cryptographic breaking is required—the attacker simply crafts a record that fails the protocol's verification checks. Once accepted and rejected, the node's DHT mechanism is poisoned for the remainder of the session, blocking all subsequent valid lookups. This can be executed repeatedly against multiple nodes with minimal cost. The attack requires network access but no authentication, making it a viable denial-of-service vector in adversarial network environments.

Remediation

Upgrade all Nimiq instances to version 1.4.0 or later. The patch relocates accumulator initialization to occur before the first record is processed, ensuring that valid records can be processed even if early records fail verification. After upgrading, restart affected nodes to activate the patched code path. No state migration or additional configuration changes are required. Verify successful upgrade by confirming the version string and observing normal DHT synchronization logs.

Patch guidance

Deploy Nimiq version 1.4.0 as the minimum patched release. Review your organization's dependency management, build, and deployment pipelines to ensure timely distribution of the patched binary. Test the upgrade in a non-critical environment first to confirm compatibility with your monitoring and infrastructure. Plan for coordinated rollout if you operate multiple validator nodes, as a phased approach can minimize disruption. Confirm that the patched version is obtained from official Nimiq repositories to avoid supply-chain risks.

Detection guidance

Monitor Nimiq node logs for repeated "DHT inconsistent state" error messages, which indicate potential poisoning attempts. Check DHT sync metrics and state retrieval success rates; a sudden drop suggests active exploitation. Implement network telemetry to identify sources of invalid DHT records. Watch for patterns of nodes reporting sync failures after specific peers join the network neighborhood. Pre-patch, you can harden exposure by restricting DHT peer connections to trusted nodes, though this reduces network redundancy. Post-patch verification can compare DHT state consistency across multiple nodes to confirm recovery.

Why prioritize this

This vulnerability merits HIGH priority remediation due to its network-level impact and ease of exploitation. Attackers do not need to compromise a node directly; they only need network presence. The condition is repeatable and affects core consensus functionality. For validators, the impact directly threatens revenue and reputation. Organizations operating Nimiq infrastructure should treat this as urgent, though the absence of active KEV exploitation tracking suggests real-world attacks are not yet documented at scale.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a high-impact availability attack (A:H) over the network (AV:N) with low attack complexity (AC:L) and no privilege or user interaction requirements. The integrity and confidentiality scores are unaffected because the attack does not exfiltrate or corrupt data—it only blocks access. The scope is unchanged (S:U) because the attack is contained to the target node's DHT function. This score appropriately captures a denial-of-service threat that can be triggered at will by any network participant.

Frequently asked questions