CVE-2026-46542

MEDIUM EPSS 13.8%
Published Jun 10, 20263w ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Jun 10, 2026 3w ago
Last Modified Jun 17, 2026 2w ago

Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability Low

Threat Intelligence

EPSS Exploit Probability
13.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-617

References 3

  • github.com https://github.com/nimiq/core-rs-albatross/pull/3713
  • github.com https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0
  • github.com https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.