CVE-2026-46542 json
nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points
published 2026-05-21 5 mo ago modified 2026-07-23 3 mo ago also EUVD-2026-35884 , GHSA-h9cc-w26m-j342
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.
Patch / fix
- crates.io nimiq-keys 1.4.0
- nimiq core-rs-albatross 1.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | nimiq-keys | <1.4.0 |
1.4.0 |
Affected products
- nimiq core-rs-albatross
Classification
- Weakness
-
- CWE-617 Reachable Assertion
References
-
github.com
/nimiq/core-rs-albatross/pull/3713
web
-
github.com
/nimiq/core-rs-albatross/commit/3bc449a8138960c4de6bfd506bad1730c621d4de
web
-
github.com
/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342
web
-
github.com
/nimiq/core-rs-albatross/releases/tag/v1.4.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-46542
advisory
-
github.com
/nimiq/core-rs-albatross
package
Sources
- CVE List CVE-2026-46542
- GitHub Advisory GHSA-h9cc-w26m-j342
- NVD CVE-2026-46542
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.