Nimiq Blockchain Kademlia DHT Record Vulnerability Causes Node Crash

A denial-of-service vulnerability has been identified in the Nimiq Blockchain Rust implementation, specifically in versions through 1.3.0. The issue arises when a malicious network peer publishes a crafted Kademlia DHT record containing a TaggedSigned<ValidatorRecord, KeyPair> with an improperly sized signature. This malformed record causes the victim node to crash when the DHT verifier attempts to validate the signature, leading to a panic. The vulnerability has been patched in version 1.4.0.

Impact

Exploitation of this vulnerability causes a panic in the affected node, leading to a crash.

Remediation

Users can upgrade to Nimiq Blockchain version 1.4.0 to address this vulnerability.