A verification function in Nimiq’s Rust transaction library asserts that the length of a proof matches the number of positions it contains. When a proof with a length mismatch is supplied, the assertion triggers a panic, causing the node to crash. The proof data originates from untrusted peer‑to‑peer responses, so an attacker can easily craft a malicious inclusion proof to induce the crash. The resulting denial of service manifests as node termination or temporary unavailability, disrupting transaction processing and consensus.

Nodes running Nimiq clients that include the nimiq‑transaction component before version 1.3.0 are vulnerable. The flaw is present in any Rust Nimiq client that processes peer‑to‑peer transaction proofs. Versions 1.3.0 and later contain the patch.

The CVSS score of 3.1 indicates low severity, consistent with a crash that compromises availability but not confidentiality or integrity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because the input comes from the network boundary, an adversary can trigger the panic by sending a crafted proof via the P2P protocol. While an exploit is straightforward once the node accepts untrusted proof data, the impact is confined to service disruption.