Intel

AIKIDO-2026-445652

nostr-sdk is vulnerable to Denial of Service

Denial of ServiceGHSA-739m-c885-58rq Published 2 days ago

60

Medium Risk

This Affects:

JAVAnostr-sdk
0.0.1 - 0.44.7
Fixed in 0.44.8
Are you affected? Scan for Free

TL;DR

The NIP-50 event-matching path searches event content using a sliding window sized from the search string length. An empty search string produces a zero-sized window, which always panics instead of returning a result. Filters carrying an empty search value therefore terminate the process rather than raising a catchable error, and the value can reach that path through direct filter matching, the bundled local relay, or in-memory database queries. The fix handles empty searches before the substring search so the matcher returns a defined result without panicking.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application matches NIP-50 search filters supplied by remote clients through direct filter matching, the bundled local relay, or in-memory database queries.

Background info

nostr-sdk is vulnerable to Denial of Service in versions 0.0.1 - 0.44.7.

How to fix this

Upgrade the org.rust-nostr:nostr-sdk, org.rust-nostr:nostr-sdk-jvm, or org.rust-nostr:nostr-sdk-kmp library to the patch version.