nimiq-blockchain’s network‑libp2p discovery module accepts signed PeerContact updates without enforcing that peer contacts contain at least one address. An attacker can send a signed PeerContact with an empty address list to a node, which is then stored in the peer contact book. When the peer contact book later builds an address book, it expects every peer to have at least one address and calls addresses.first().expect(...). The empty list causes a panic, crashing the node or its RPC task. This leads to a denial of service but does not provide arbitrary code execution or data exfiltration.

Vendors: Nimiq. Product: nimiq‑blockchain (core‑rs‑albatross). Versions affected are 1.3.0 and all earlier releases. The issue was fixed in release 1.4.0.

The CVSS score is 4.3, indicating moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector relies on an untrusted peer on the network delivering a signed PeerContact with an empty address list. Successful exploitation results only in a node crash, so an attacker would need network access to the node’s peer discovery channel. Because no authentication is required beyond accepting signed contacts, the vulnerability is easily exploitable by any remote node.