CVE-2026-46542 Details

A denial-of-service vulnerability has been identified in the Nimiq Rust implementation of the Proof-of-Stake protocol, prior to version 1.4.0. The issue arises in the Ed25519 multisig delinearization process, where the function Ed25519PublicKey::delinearize() improperly handles curve point validation. It calls .unwrap() on the decomposition of curve points, leading to a panic when a public key is formed from 32 bytes that do not correspond to a valid point on the Ed25519 curve. This vulnerability can cause the hosting process to crash, as the public key construction only checks byte length without verifying curve membership. Consequently, invalid keys can bypass initial validation and trigger a crash during the delinearization process.

Users can update to Nimiq version 1.4.0, which addresses this vulnerability by improving curve point validation in the multisig delinearization process.