The vulnerability (CVE-2026-40092) exists in the nimiq-blockchain's Rust implementation core-rs-albatross, specifically in versions prior to 1.4.0. A malicious peer can send a Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with an Ed25519 signature field whose byte length is not exactly 64 bytes. When the node attempts to verify this signature, the Ed25519Signature::from_bytes(sig).unwrap() call panics because the underlying ed25519_zebra::Signature::try_from rejects invalid-length slices. This unchecked unwrap leads to a denial-of-service crash of the full node. The BLS signature verification path does not panic, only the Ed25519 implementation is affected. The issue has been addressed in version 1.4.0.

Exploitation of this vulnerability results in a denial-of-service condition by crashing any Nimiq full node that processes the maliciously crafted DHT record. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported.

Upgrade to nimiq core-rs-albatross version 1.4.0 or later, where this issue has been fixed. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 1.4.0. Until upgraded, nodes remain vulnerable to denial-of-service via crafted DHT records.