Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M

CVE-2026-46541Nimiq network-libp2p: DHT query poisoning via first-record verification failure

High 7.5

In plain English

A high-severity security flaw in core-rs-albatross from nimiq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 71.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsistent state" errors. This issue has been patched in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
nimiq	core-rs-albatross	< 1.4.0

Weakness: CWE-754 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-ccqv-2c9q-mqw5 x_refsource_CONFIRM
https://github.com/nimiq/core-rs-albatross/pull/3707 x_refsource_MISC
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0 x_refsource_MISC