CVE-2026-46542

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nimiq/core-rs-albatross/pull/3713
https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0
https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342

Configurations

No configuration.

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Nimiq es una implementación en Rust del protocolo Nimiq Proof-of-Stake basado en el algoritmo de consenso Albatross. Antes de la versión 1.4.0, existe una vulnerabilidad de denegación de servicio en la ruta de código de deslinearización multisig Ed25519. Ed25519PublicKey::delinearize() en keys/src/multisig/mod.rs llamó a .unwrap() en la descompresión de puntos de curva, lo que provoca un pánico cuando se construye una clave pública a partir de 32 bytes que no representan un punto válido en la curva Ed25519. La construcción de Ed25519PublicKey solo valida la longitud en bytes, no la pertenencia a la curva, por lo que las claves no válidas pueden alcanzar la ruta de deslinearización y bloquear el proceso anfitrión. Este problema ha sido parcheado en la versión 1.4.0.

10 Jun 2026, 00:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-10 00:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46542

Mitre link : CVE-2026-46542

CVE.ORG link : CVE-2026-46542

JSON object : View

Products Affected

No product.

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-46542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46542", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T13:10:51.570876Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nimiq", "product": "core-rs-albatross", "versions": [{"status": "affected", "version": "< 1.4.0"}]}]}], "published": "2026-06-10T00:16:54.500", "references": [{"url": "https://github.com/nimiq/core-rs-albatross/pull/3713", "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0."}, {"lang": "es", "value": "Nimiq es una implementaci\u00f3n en Rust del protocolo Nimiq Proof-of-Stake basado en el algoritmo de consenso Albatross. Antes de la versi\u00f3n 1.4.0, existe una vulnerabilidad de denegaci\u00f3n de servicio en la ruta de c\u00f3digo de deslinearizaci\u00f3n multisig Ed25519. Ed25519PublicKey::delinearize() en keys/src/multisig/mod.rs llam\u00f3 a .unwrap() en la descompresi\u00f3n de puntos de curva, lo que provoca un p\u00e1nico cuando se construye una clave p\u00fablica a partir de 32 bytes que no representan un punto v\u00e1lido en la curva Ed25519. La construcci\u00f3n de Ed25519PublicKey solo valida la longitud en bytes, no la pertenencia a la curva, por lo que las claves no v\u00e1lidas pueden alcanzar la ruta de deslinearizaci\u00f3n y bloquear el proceso anfitri\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 1.4.0."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security-advisories@github.com"}