A vulnerability in Nimiq network-libp2p allows remote, unauthenticated attackers to cause a denial of service by triggering a panic that takes the node's P2P networking offline.

The vulnerability exists in the discovery protocol state machine, which incorrectly assumes a maximum of one inbound and one outbound substream per connection. An unauthenticated attacker can trigger a reachable assertion panic by opening or negotiating a secondary discovery substream, leading to the immediate termination of the networking task.

Successful exploitation of this vulnerability results in a denial of service for the affected node, effectively severing its participation in the P2P network. Given a CVSS score of 7.5, the impact is considered High due to the ease of remote exploitation without authentication. This could lead to significant operational disruption for nodes required for consensus or network synchronization, potentially causing cascading effects on service availability.

Immediate Action: Update the Nimiq network-libp2p implementation to version 1.3.0 or later to include the necessary fix for the assertion failure.

Proactive Monitoring: Monitor network node logs for unexpected service restarts or panic messages related to the network-libp2p discovery handler.

Compensating Controls: While no specific workarounds exist, implement network-level rate limiting or ingress filtering to reduce the impact of malformed or redundant substream requests from untrusted peers.

Public Exploit Available: No

The risk posed by CVE-2026-34063 is significant due to the ease with which an unauthenticated remote attacker can force a node to go offline. Administrators operating Nimiq nodes should prioritize upgrading to version 1.3.0 immediately to resolve this assertion vulnerability. Failure to patch leaves critical infrastructure susceptible to trivial denial of service attacks that can degrade network performance and stability.