The vulnerability in nimiq-libp2p versions before 1.3.0 arises because the MessageCodec::read_request and read_response methods call read_to_end() on inbound substreams, allowing a remote peer to send only partial frames and keep the substream open indefinitely. Additionally, the Behaviour::new configuration sets with_max_concurrent_streams to 1000, which is significantly higher than the library default, increasing the number of stalled substreams that can be maintained simultaneously. This results in allocation of resources without limits or throttling (CWE-770), potentially leading to denial of service by exhausting available substream slots. The issue is addressed in version 1.3.0 of the library. There are no known workarounds.

The vulnerability allows a remote attacker to keep inbound substreams open by sending partial frames, which can exhaust the node's resources allocated for handling concurrent streams. This can cause denial of service conditions by stalling legitimate network activity. The CVSS score of 5.3 reflects a medium severity impact with no confidentiality or integrity loss but availability impact due to resource exhaustion.

A patch fixing this vulnerability is available in nimiq network-libp2p version 1.3.0. Users should upgrade to version 1.3.0 or later to remediate this issue. No known workarounds exist, so upgrading is the recommended and necessary action.