Nimiq network-libp2p CVE-2026-34063

Remote network connectivity to Nimiq blockchain nodes running network-libp2p versions prior to 1.3.0. No authentication, special privileges, or user interaction required (CVSS: PR:N/UI:N). Exploitation requires only the ability to establish standard libp2p connections and negotiate the discovery protocol, both of which are necessary for normal peer-to-peer blockchain operation. Nodes must have their P2P networking port accessible to potential attackers, which is typical for public blockchain validators and full nodes. Attack complexity is low (AC:L) as the vulnerability is triggered by straightforward protocol behavior rather than race conditions or complex timing. No specific configuration settings limit exploitation - default installations are vulnerable. The only factor preventing exploitation is network isolation, which contradicts the fundamental purpose of blockchain peer-to-peer nodes.

CVSS 7.5 (High) reflects network-accessible, low-complexity attack requiring no authentication or user interaction, with complete availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates any remote attacker can trigger the vulnerability by simply opening duplicate discovery substreams, making this trivially exploitable. For blockchain infrastructure, this represents critical operational risk as networking downtime directly impacts consensus participation, transaction processing, and network health. However, impact is limited to availability (C:N/I:N) with no confidentiality or integrity consequences, and recovery requires only service restart rather than data restoration. No EPSS score or KEV status provided, but the simplicity of exploitation (duplicate protocol negotiation), confirmed patch availability (v1.3.0 released), and lack of workarounds elevate this to immediate patching priority for production Nimiq nodes. The GitHub advisory and merged PR #3666 confirm vendor acknowledgment and fix verification. SSVC classification would likely be 'Scheduled' rather than 'Out-of-Cycle' given DoS-only impact, but blockchain operators should treat as urgent given network participation requirements.

An attacker identifies Nimiq blockchain nodes running vulnerable network-libp2p versions through network scanning or public peer lists. The attacker establishes a standard libp2p connection to the target node and successfully negotiates the discovery protocol once (normal behavior). Without closing the connection, the attacker initiates a second discovery protocol negotiation on the same connection. The vulnerable handler receives the duplicate substream request and executes the panic assertion, immediately crashing the networking swarm task and taking the node's P2P capabilities offline. The node stops participating in blockchain consensus, processing transactions, and serving peer requests until an operator manually restarts the service. The attacker can repeat this against multiple nodes to disrupt network stability.