EUVD-2026-31197
GHSA-27w2-87xv-37c6
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Blast Radius
ecosystem impact- 19 cargo packages depend on nimiq-keys (15 direct, 4 indirect)
Ecosystem-wide dependent count for version 0.2.0.
DescriptionNVD
Impact
A malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64. When the victim node's DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics.
Patches
The patch for this vulnerability is formally released as part of v1.4.0.
Workarounds
No known workarounds.
Resources
See PR.
AnalysisAI
Remote denial-of-service vulnerability in Nimiq full nodes allows unauthenticated attackers to crash nodes by publishing malformed Kademlia DHT records with incorrect Ed25519 signature lengths. The vulnerability triggers a panic in the Ed25519 signature verification code when processing DHT records with signatures not exactly 64 bytes. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all Nimiq full node deployments and document current versions. Within 7 days: apply vendor-released patch v1.4.0 to all affected nodes, beginning with non-critical infrastructure to validate stability. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today