CVE-2026-44505

Name of the Vulnerable Software and Affected Versions Nimiq network-libp2p versions prior to 1.4.0

Description In the Rust implementation of the Nimiq Proof-of-Stake protocol, the handle dht get() function in network-libp2p/src/swarm.rs fails to properly manage query progress when a peer returns a FoundRecord. If the dht verifier.verify() function encounters an error, the system logs the event and returns early without completing the oneshot channel used by Network::dht get or cleaning up per-query bookkeeping. Subsequent query progress may trigger a DHT inconsistent state path and also return without cleanup. Since Network::dht get awaits the oneshot without a timeout, the caller future can hang indefinitely.

Recommendations Update to version 1.4.0.