nimiq core-rs-albatross up to 1.3.x swarm.rs Network::dht_get exceptional condition

Summaryinfo

A vulnerability labeled as problematic has been found in nimiq core-rs-albatross up to 1.3.x. This issue affects the function Network::dht_get of the file network-libp2p/src/swarm.rs. The manipulation results in exceptional condition. This vulnerability is cataloged as CVE-2026-44505. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in nimiq core-rs-albatross up to 1.3.x. Affected is the function Network::dht_get of the file network-libp2p/src/swarm.rs. The manipulation with an unknown input leads to a exceptional condition vulnerability. CWE is classifying the issue as CWE-755. The product does not handle or incorrectly handles an exceptional condition. This is going to have an impact on availability. CVE summarizes:

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dht_get (network-libp2p/src/swarm.rs). Prior to version 1.4.0, when a peer returns a FoundRecord, the code verifies the record via dht_verifier.verify(&record.record). On verifier error, handle_dht_get logs and returns early without completing the oneshot used by Network::dht_get, and without cleaning up per-query bookkeeping. Later query progress can hit the "DHT inconsistent state" path and also return without cleanup. Because Network::dht_get awaits the oneshot without a timeout, the caller future can hang indefinitely. This issue has been patched in version 1.4.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-44505 since 05/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.4.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-35876). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• nimiq

Name

• core-rs-albatross

Version

• 1.0
• 1.1
• 1.2
• 1.3

Website

• Product: https://github.com/nimiq/core-rs-albatross/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion