A malformed first DHT record in a Nimiq node prevents the proper initialization of the results accumulator, causing all subsequent valid records to be discarded and the DHT to report an inconsistent state. The attacker can thus cause a node to fall out of sync with the network or become unable to process legitimate DHT queries, resulting in a loss of service availability. The weakness is a verification failure, classified as CWE-754.

The vulnerability affects the Nimiq core-rs-albatross implementation until version 1.4.0. Systems running any earlier releases are susceptible to the denial of service condition described.

The CVSS score of 7.5 indicates a moderate to high severity risk, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is a malicious peer in the libp2p DHT network that can inject a bad first record; the attacker does not need local access to the node. When the vulnerable node contacts such a peer, it becomes unable to process subsequent queries, effectively disrupting its participation in the blockchain network.