CVE-2026-46541 describes an improper check for unusual or exceptional conditions (CWE-754) in the Nimiq core-rs-albatross implementation of the Albatross consensus algorithm. Specifically, in the handle_dht_get() function, the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record is malicious and fails verification, the accumulator is never created, causing all subsequent valid records to be discarded with "DHT inconsistent state" errors. This can disrupt the normal operation of the protocol. The vulnerability affects versions prior to 1.4.0 and has been patched in version 1.4.0.

The vulnerability can cause denial of service conditions by discarding valid DHT records following a malicious first record, potentially disrupting the Nimiq Proof-of-Stake protocol's consensus operations. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact.

Upgrade to Nimiq core-rs-albatross version 1.4.0 or later, where this issue has been patched. No other mitigation is indicated. Patch status is confirmed by the vendor advisory stating the fix is in version 1.4.0.