CVE-2026-46542

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. This issue has been patched in version 1.4.0.

• CWE-617

• https://github.com/nimiq/core-rs-albatross/pull/3713
• https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0
• https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342

Published

Jun 10, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46532ESF-IDF is the Espressif Internet of Things (IOT) Developmen…4.6
• CVE-2026-46538Microsoft UFO open-source framework for intelligent automati…5.9
• CVE-2026-46539Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.9
• CVE-2026-4654The Awesome Support – WordPress HelpDesk & Support Plugin pl…5.3
• CVE-2026-46540Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…6.5
• CVE-2026-46541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…7.5
• CVE-2026-46543Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.3
• CVE-2026-46544Microsoft UFO open-source framework for intelligent automati…5.3
• CVE-2026-46545Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…7.5
• CVE-2026-46546Frappe Learning Management System (LMS) is a learning system…5.4
• CVE-2026-46547NocoDB is software for building databases as spreadsheets. P…6.1
• CVE-2026-46548NocoDB is software for building databases as spreadsheets. P…4.3