NRDAX-T0009 - Bit-Length Validation Panic

Pending classification · active · first seen 2026-07-17

Producer label: compute_amp. Not yet assigned a mechanism family.

provenance: Reproduced in NullRabbit's attack-reproduction pipeline

mechanism

CVE-2026-40092 / GHSA-27w2-87xv-37c6 (nimiq/core-rs-albatross, nimiq/core-rs-albatross before v1.4.0): validator records are published into the libp2p Kademlia DHT (/nimiq/kad/0.0.1) as TaggedSigned<ValidatorRecord> (tag 0x03). With set_record_filtering(FilterBoth) every inbound PUT_VALUE reaches Verifier::verify_validator_record, which calls validator_record.verify() -> TaggedPublicKey::verify for Ed25519, previously `Ed25519Signature::from_bytes(sig).unwrap()`. ed25519_zebra rejects any non-64-byte slice, so a record whose TaggedSignature byte-vector is not 64 bytes panics via unwrap() → remote unauthenticated crash DoS. Fixed in v1.4.0 (PR #3708, commit 807ee8e) (return false instead of unwrap). https://github.com/advisories/GHSA-27w2-87xv-37c6

live exposure

No exposure data. Slashr ↗ has no risk signal mapped to this technique yet — absence of data is not absence of exposure.

instances (1)

chain	primitive	fidelity	origin	reproducer (bundle)	source
nimiq	nimiq_dht_sig_length_panic	lab	reverse-engineered-cve	nimiq_dht_sig_length_panic	-

cite

https://nrdax.com/techniques/NRDAX-T0009

plain

NRDAX Registry. Technique NRDAX-T0009.

bibtex

@misc{nrdax_NRDAX_T0009,
  title = {Bit-Length Validation Panic (NRDAX-T0009)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0009},
}

json (csl)

{
  "id": "nrdax-NRDAX-T0009",
  "type": "dataset",
  "title": "Bit-Length Validation Panic (NRDAX-T0009)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0009",
  "publisher": "NRDAX Registry"
}

badge

[![NRDAX-T0009 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0009.svg)](https://nrdax.com/techniques/NRDAX-T0009-bit-length-validation-panic)

use from the CLI

Retrieve or cite this technique from a script or the terminal with the NRDAX Python library & CLI.

Retrieve this technique

nrdax get NRDAX-T0009

Cite it (BibTeX)

nrdax cite NRDAX-T0009 --format bibtex

CLI guide → GitHub ↗