core-rs-albatross EUVD-2026-31195

The attacker must be a participant in the libp2p peer discovery network - they need to be able to send signed PeerContact messages that the target node will accept and store. No authentication to the target node is required (PR:N in CVSS vector). The crash is not triggered by the attacker directly; it requires a subsequent call to get_address_book, which is exposed via the node's RPC interface or web client (UI:R in CVSS vector). This means exploitation depends on: (1) the target node running core-rs-albatross < 1.4.0; (2) the attacker's ability to insert a peer contact into the discovery layer; and (3) a legitimate user or automated process invoking the address book RPC endpoint after the malicious contact is stored. Exploitation is limited by the need for the second-phase trigger - an operator or client must call get_address_book for the panic to fire. Nodes whose RPC endpoints are not regularly queried, or are firewalled from external callers, reduce the window for the crash to be triggered.

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N) trigger requiring user interaction (UI:R), with no confidentiality or integrity impact and only partial availability impact (A:L). The UI:R element is meaningful: exploitation is two-phase - the attacker injects the malicious contact passively, but the panic only fires when a legitimate user or process calls get_address_book, such as a node operator querying RPC or a connected web client. This decouples the attacker from the crash timing and may make detection harder. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not in the CISA KEV catalog, and no public exploit code has been identified. In practice, the availability impact may exceed the A:L CVSS rating if the panic terminates the entire node process rather than just the RPC task - Rust panic behavior is configurable. Overall: genuine operational risk for node operators, but not an emergency given the absence of active exploitation evidence.

An attacker operating a Nimiq node joins the libp2p peer discovery network and crafts a signed PeerContact message containing a valid peer identity but an empty addresses field, then broadcasts it to target nodes; since no protocol validation rejects empty address lists, the contact is accepted and stored in the target's PeerContactBook. Later, when a node operator or automated monitoring script queries the node's RPC interface or web client - a routine operational action - the get_address_book call internally invokes .expect() on the empty address list, triggering a Rust panic that crashes the RPC task or the node process entirely.