A bug in the network-libp2p component of the Nimiq core-rs-albatross client allows an untrusted peer to cause a DHT query to hang indefinitely. When a peer returns a FoundRecord that fails verification, the evaluator logs the error and prematurely returns without completing the oneshot used by the dht_get future. This leaves the query bookkeeping in an inconsistent state and can trigger a path that also returns without cleanup. Consequently, Network::dht_get awaits a oneshot that never resolves, leading to an indefinite stall of the caller future and a loss of service availability.

The vulnerability affects the Nimiq core-rs-albatross implementation of the Nimiq Proof‑of‑Stake protocol, specifically the network‑libp2p module that handles DHT queries. Versions prior to 1.4.0 are impacted. The upgrade to 1.4.0 includes the fix that ensures normal cleanup and timeout handling.

The CVSS score is 5.3, reflecting moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating a lower immediate exploitation likelihood. However, the flaw can be triggered by any peer that connects to the vulnerable node, so an attacker can remotely exploit the vulnerability by sending a crafted response that causes verification to fail. The absence of a timeout on the waiting future means the node will hang until manual intervention or a reboot, providing a denial‑of‑service vector.