CVE-2026-40094

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and prior, network-libp2p discovery accepts signed PeerContact updates from untrusted peers and stores them in a peer contact book, eventually leading to address book crash. A PeerContact can legally contain an empty addresses list (no intrinsic validation enforces non-empty). Later, PeerContactBook::known_peers builds an address book by taking addresses.first().expect("every peer should have at least one address"). If the attacker has inserted a signed peer contact with addresses=[], any call to get_address_book (RPC/web client) can panic and crash the node/RPC task depending on panic settings. This issue has been fixed in version 1.4.0.

• CWE-754

• https://github.com/nimiq/core-rs-albatross/pull/3715
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-c45m-6x25-3cjq

Published

May 20, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40089Sonicverse is a Self-hosted Docker Compose stack for live ra…9.9
• CVE-2026-4009A vulnerability has been found in jarikomppa soloud up to 20…3.3
• CVE-2026-40090Zarf is an Airgap Native Packager Manager for Kubernetes. Ve…7.1
• CVE-2026-40091SpiceDB is an open source database system for creating and m…4.4
• CVE-2026-40092nimiq-blockchain provides persistent block storage for Nimiq…7.5
• CVE-2026-40093nimiq-blockchain provides persistent block storage for Nimiq…8.1
• CVE-2026-40096immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-40097Step CA is an online certificate authority for secure, autom…3.7
• CVE-2026-40098Magento Long Term Support (LTS) is an unofficial, community-…5.4
• CVE-2026-40099Kirby is an open-source content management system. Kirby's u…6.5
• CVE-2026-4010A vulnerability was found in ThakeeNathees pocketlang up to …3.3
• CVE-2026-40100FastGPT is an AI Agent building platform. Prior to 4.14.10.3…5.3