The Nimiq nimiq-primitives library is vulnerable to a denial of service attack, allowing an unauthenticated remote peer to crash nodes via malformed network traffic.

This vulnerability involves improper handling of exceptional conditions during the processing of election macro blocks. An unauthenticated attacker can force a node to panic by providing an invalid compressed BLS voting key, which triggers an unchecked unwrap operation.

Successful exploitation results in a denial of service, causing the affected Nimiq node to crash and become unavailable. With a CVSS score of 7.5, this high-severity vulnerability poses a significant risk to network availability and service continuity for organizations relying on the Nimiq protocol.

Immediate Action: Update the nimiq-primitives library to version 1.3.0 or later to incorporate the necessary fix for handling invalid BLS keys.

Proactive Monitoring: Monitor node logs for unexpected panic events or recurring crash loops that may indicate attempted exploitation of this flaw.

Compensating Controls: Implement strict network-level filtering or peer-reputation systems to limit the ability of untrusted or unknown nodes to broadcast malicious macro blocks to your infrastructure.

Public Exploit Available: No (exploit_available: false)

The ability for an unauthenticated attacker to remotely crash nodes creates a high risk of service disruption. Administrators should prioritize upgrading to version 1.3.0 immediately to eliminate this vulnerability. Until updates are applied, ensure that node monitoring is active to detect and respond to potential service outages caused by exploitation attempts.