SecuriTricks - CVE-2026-46542

Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.

Product(s) Impacted

Vendor	Product	Versions
Nimiq	Nimiq	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	nimiq	nimiq	/	/	/	/	/	/	/	/

References

https://github.com/nimiq/core-rs-albatross/pull/3713

https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0

https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342

CVSS Score

4.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

View Vector String

Timeline

Published: June 10, 2026, 12:16 a.m.
Last Modified: June 10, 2026, 12:16 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-46542