QSearchQSearch

CVE-2026-46542

4.3 MEDIUM

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm

Published: 2026-06-10 · Last updated: 2026-06-10

Severity and scoring

CVSS
4.3 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
CWE-617

Description

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-46543 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (5.3 MEDIUM)
  • CVE-2026-9750 — An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents that interfere with internal ... (6.5 MEDIUM)
  • CVE-2026-9749 — This issue can occur when running an aggregation pipeline that uses the internal $exchange stage configured with key-range partitioning a... (6.5 MEDIUM)
  • CVE-2026-9748 — The $_internalConvertBucketIndexStats stage used PauseExecution as a way to signal "skip this document" when an index stats conversion fa... (6.5 MEDIUM)
  • CVE-2026-9747 — Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server (6.5 MEDIUM)