CVE-2026-34062

nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and `read_response` call `read_to_end()` on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because `Behaviour::new` also sets `with_max_concurrent_streams(1000)`, the node exposes a much larger stalled-slot budget than the library default. The patch for this vulnerability is formally released as part of v1.3.0. No known workarounds are available.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nimiq/core-rs-albatross/commit/c021a5337b808c73571b44999f9753051bac7508	Patch
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0	Release Notes
https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gh7r-qh4p-q4fr	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) nimiq-libp2p es una implementación de red Nimiq basada en libp2p. Antes de la versión 1.3.0, ’MessageCodec::read_request’ y ’read_response’ llaman a ’read_to_end()’ en subflujos entrantes, de modo que un par remoto puede enviar solo una trama parcial y mantener el subflujo abierto. Debido a que ’Behaviour::new’ también establece ’with_max_concurrent_streams(1000)’, el nodo expone un presupuesto de ranuras estancadas mucho mayor que el valor predeterminado de la biblioteca. El parche para esta vulnerabilidad se lanza formalmente como parte de la v1.3.0. No se conocen soluciones alternativas disponibles.

Information

Published : 2026-04-22 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34062

Mitre link : CVE-2026-34062

CVE.ORG link : CVE-2026-34062

JSON object : View

Products Affected

nimiq

nimiq_proof-of-stake

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-34062", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34062", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T12:57:31.642650Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nimiq", "product": "network-libp2p", "versions": [{"status": "affected", "version": "< 1.3.0"}]}]}], "published": "2026-04-22T20:16:40.530", "references": [{"url": "https://github.com/nimiq/core-rs-albatross/commit/c021a5337b808c73571b44999f9753051bac7508", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-gh7r-qh4p-q4fr", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCodec::read_request` and `read_response` call `read_to_end()` on inbound substreams, so a remote peer can send only a partial frame and keep the substream open. because `Behaviour::new` also sets `with_max_concurrent_streams(1000)`, the node exposes a much larger stalled-slot budget than the library default. The patch for this vulnerability is formally released as part of v1.3.0. No known workarounds are available."}, {"lang": "es", "value": "nimiq-libp2p es una implementaci\u00f3n de red Nimiq basada en libp2p. Antes de la versi\u00f3n 1.3.0, \u2019MessageCodec::read_request\u2019 y \u2019read_response\u2019 llaman a \u2019read_to_end()\u2019 en subflujos entrantes, de modo que un par remoto puede enviar solo una trama parcial y mantener el subflujo abierto. Debido a que \u2019Behaviour::new\u2019 tambi\u00e9n establece \u2019with_max_concurrent_streams(1000)\u2019, el nodo expone un presupuesto de ranuras estancadas mucho mayor que el valor predeterminado de la biblioteca. El parche para esta vulnerabilidad se lanza formalmente como parte de la v1.3.0. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "CD0CAAD1-7626-4A4A-A6F8-9DC46FE50731", "versionEndExcluding": "1.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}