CVE-2026-46542 nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points
Attackers can crash the application by providing invalid Ed25519 public keys to the delinearization function, causing a panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46542?
CVE-2026-46542 is a medium-severity denial of service vulnerability in nimiq core-rs-albatross, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.
Weakness: CWE-617
Which versions are affected by CVE-2026-46542?
2 open source packages ship an affected version, including nimiq-keys.
| Package | Affected | Fixed in |
|---|---|---|
nimiq-keys crates.io | All versions | 1.4.0 |
nimiq-keys crates.io | All versions | 1.4.0 |
How do I fix CVE-2026-46542?
Upgrade nimiq-keys to 1.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46542 being exploited?
There is no known exploitation of CVE-2026-46542 in the wild and no public exploit code.
Sources
Also known as GHSA-h9cc-w26m-j342.