PT-2026-48332 · Nimiq · Nimiq

CVE-2026-46541

·

Published

2026-06-09

·

Updated

2026-06-10

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.4.0
Description In the handle dht get() function, the DhtResults accumulator is only initialized if the first DHT record passes verification. If a malicious DHT node causes the first record to fail, the DhtResults is not created, leading to all subsequent valid records being discarded with "DHT inconsistent state" errors. This allows for DHT query poisoning.
Recommendations Update to version 1.4.0.

Exploit

Fix

Improper Check for Exceptional Conditions

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2026-46541
GHSA-CCQV-2C9Q-MQW5

Affected Products

Nimiq