https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 00:43:00 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40092 <p><strong>Affected:</strong> nimiq core-rs-albatross</p> <p>nimiq-blockchain provides persistent block storage for Nimiq&#39;s Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned&lt;ValidatorRecord, KeyPair&gt; with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node&#39;s DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.</p> <p><strong>Affected:</strong> nimiq core-rs-albatross</p> <p>nimiq-blockchain provides persistent block storage for Nimiq&#39;s Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record would contain a TaggedSigned&lt;ValidatorRecord, KeyPair&gt; with a signature field whose byte length is not exactly 64 in order to cause a crash. When the victim node&#39;s DHT verifier calls TaggedSigned::verify, execution reaches Ed25519Signature::from_bytes(sig).unwrap() in the TaggedPublicKey implementation for Ed25519PublicKey. The from_bytes call fails because ed25519_zebra::Signature::try_from rejects slices not 64 bytes, and the unwrap() panics. The BLS TaggedPublicKey implementation correctly returns false on error; only the Ed25519 implementation panics. This issue has been fixed in version 1.4.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-40092