CVE-2026-44505: CWE-755: Improper Handling of Exceptional Conditions in nimiq core-rs-albatross
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dht_get (network-libp2p/src/swarm.rs). Prior to version 1.4.0, when a peer returns a FoundRecord, the code verifies the record via dht_verifier.verify(&record.record). On verifier error, handle_dht_get logs and returns early without completing the oneshot used by Network::dht_get, and without cleaning up per-query bookkeeping. Later query progress can hit the "DHT inconsistent state" path and also return without cleanup. Because Network::dht_get awaits the oneshot without a timeout, the caller future can hang indefinitely. This issue has been patched in version 1.4.0.
AI Analysis
Technical Summary
In the nimiq core-rs-albatross Rust implementation of the Nimiq Proof-of-Stake protocol, specifically in network-libp2p's handling of kad get-record queries, verifier errors during record verification cause early returns without completing the oneshot or cleaning up query bookkeeping. This leads to a potential indefinite hang of the caller awaiting the oneshot, as no timeout is implemented. The problem affects versions prior to 1.4.0 and has been patched in version 1.4.0.
Potential Impact
The vulnerability results in a denial of service condition where the caller awaiting the dht_get query can hang indefinitely, impacting availability. There is no confidentiality or integrity impact reported.
Mitigation Recommendations
Upgrade to nimiq core-rs-albatross version 1.4.0 or later, where this issue has been patched. No other mitigation is indicated.
CVE-2026-44505: CWE-755: Improper Handling of Exceptional Conditions in nimiq core-rs-albatross
Description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dht_get (network-libp2p/src/swarm.rs). Prior to version 1.4.0, when a peer returns a FoundRecord, the code verifies the record via dht_verifier.verify(&record.record). On verifier error, handle_dht_get logs and returns early without completing the oneshot used by Network::dht_get, and without cleaning up per-query bookkeeping. Later query progress can hit the "DHT inconsistent state" path and also return without cleanup. Because Network::dht_get awaits the oneshot without a timeout, the caller future can hang indefinitely. This issue has been patched in version 1.4.0.
CVSS v3.1
Score 5.3medium
Affected software
pkg:cargo/github/nimiq/core-rs-albatrossRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In the nimiq core-rs-albatross Rust implementation of the Nimiq Proof-of-Stake protocol, specifically in network-libp2p's handling of kad get-record queries, verifier errors during record verification cause early returns without completing the oneshot or cleaning up query bookkeeping. This leads to a potential indefinite hang of the caller awaiting the oneshot, as no timeout is implemented. The problem affects versions prior to 1.4.0 and has been patched in version 1.4.0.
Potential Impact
The vulnerability results in a denial of service condition where the caller awaiting the dht_get query can hang indefinitely, impacting availability. There is no confidentiality or integrity impact reported.
Mitigation Recommendations
Upgrade to nimiq core-rs-albatross version 1.4.0 or later, where this issue has been patched. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T18:28:20.886Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a28a8098dd33fbd8595f11d
Added to database: 06/09/2026, 23:55:53 UTC
Last enriched: 06/17/2026, 08:51:17 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.