nimiq-libp2p EUVD-2026-25056

The vulnerability requires only that the target node is running nimiq-libp2p version prior to 1.3.0 and is connected to the attacker on the Nimiq libp2p network. No special configuration, feature flag enablement, or non-default settings are required - the vulnerability is inherent to the library's default behavior. The attacker must be able to establish libp2p connections to the target node (which is the normal operational mode for Nimiq nodes); no privileged access or authentication is needed. The attack is limited only by the per-connection resource budget and the attacker's ability to maintain concurrent connections.

CVSS 5.3 with network vector (AV:N/AC:L/PR:N/UI:N) and low confidentiality/integrity impact but availability impact (A:L) accurately reflects this as a classic resource exhaustion denial of service. EPSS data not provided; however, the attack is trivial to execute - no authentication, no user interaction, and low complexity. The vulnerability affects all Nimiq nodes running libp2p prior to 1.3.0, creating a direct attack surface for anyone running a Nimiq node on the network. The availability impact is bounded (A:L suggests partial degradation rather than complete loss) because the node can still function under attack, but coordinated attacks from multiple malicious peers can cumulatively exhaust resources. KEV status not provided, but the public GitHub advisory and commit fix suggest vendor awareness. Real-world risk is moderate to high for Nimiq network operators because this is a direct remote DoS against any unpatched node, requiring no sophisticated exploitation.

An attacker operating a malicious Nimiq network peer opens 1000 concurrent substreams to a target node and sends a single partial frame on each without closing the streams. The target node's MessageCodec calls read_to_end() and blocks indefinitely waiting for stream closure. As the attacker repeats this across multiple connections, the target node accumulates thousands of stalled streams, exhausting memory and connection state until legitimate peer traffic is degraded or rejected.