Denial-of-Service Vulnerability in Nimiq Rust Implementation of Proof-of-Stake Protocol

CVE-2026-46542

What is CVE-2026-46542?

A denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path of the Nimiq Rust implementation prior to version 1.4.0. This issue occurs due to inadequate validation when constructing public keys from byte arrays. The Ed25519PublicKey::delinearize() function calls .unwrap() on curve point decompression which can panic if a public key consists of 32 bytes that do not correspond to a valid point on the Ed25519 curve. As a result, invalid keys can trigger the delinearization path and cause the hosting process to crash. The vulnerability is addressed in version 1.4.0.

References