# CVE-2026-46542: Nimiq core-rs-albatross DoS in Ed25519 multisig delinearization

Source: https://junglewise.ai/threats/cve-2026-46542-nimiq-core-rs-albatross-dos-in-ed25519-multisig-delinearization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-46542 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Nimiq is a blockchain protocol implementation. A flaw in how it handles multi-signature (multisig) wallet operations allows an attacker to crash a user's wallet application. To exploit this, an attacker must convince a user to include a specially crafted, invalid public key in a multisig transaction setup. While this can disrupt the user's ability to perform transactions, it does not affect the security of the underlying blockchain or validator nodes.

Technologies: [Nimiq Core-Rs-Albatross](https://junglewise.ai/threats/technologies/core-rs-albatross). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Nimiq](https://junglewise.ai/threats/vendors/nimiq).

## Quick answers

**Is CVE-2026-46542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46542 being exploited in the wild.

**How severe is CVE-2026-46542?** Medium severity, with a CVSS score of 4.3, published 10 June 2026.

**Which products and versions are affected?** nimiq-keys (crates.io) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0; Nimiq Core-Rs-Albatross <= 1.3.0.

**Is there a fix for CVE-2026-46542?** Yes. nimiq-keys (crates.io): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46542 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46542?** Check whether you run nimiq-keys (crates.io) or Nimiq Core-Rs-Albatross at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nimiq-keys (crates.io): upgrade to 1.4.0 or later

  ```sh
  cargo update -p nimiq-keys
  ```


## Technical details

A denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path within the `nimiq-keys` crate. The `Ed25519PublicKey::delinearize()` function in `keys/src/multisig/mod.rs` and the `Commitment::From<[u8; 32]>` implementation improperly used `.unwrap()` on curve point decompression. Because public key construction only validated byte length rather than curve membership, an attacker can provide 32 bytes that do not represent a valid Ed25519 point, triggering a panic and process crash. This is reachable via untrusted input in wallet and web-client multisig flows but does not affect consensus or validator nodes. The issue is fixed in version 1.4.0 by replacing panics with proper error propagation.

## Affected products

- Nimiq Nimiq core-rs-albatross <= 1.3.0
- Nimiq nimiq-keys <= 1.3.0

## Identifiers

- CVE-2026-46542
- GHSA-h9cc-w26m-j342

## Timeline

- 2026-04-22: patched: Fix merged in PR 3713 and released in v1.4.0
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/nimiq/core-rs-albatross/pull/3713](https://github.com/nimiq/core-rs-albatross/pull/3713)
- [https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0](https://github.com/nimiq/core-rs-albatross/releases/tag/v1.4.0)
- [https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342](https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-h9cc-w26m-j342)

## Related threats

- [Nimiq nimiq-primitives out-of-bounds panic in KeyNibbles::Add](https://junglewise.ai/threats/cve-2026-54542-nimiq-nimiq-primitives-out-of-bounds-panic-in-keynibbles-add)
- [Nimiq nimiq-primitives panic in TrieProof::verify](https://junglewise.ai/threats/cve-2026-54541-nimiq-nimiq-primitives-panic-in-trieproof-verify)
- [Nimiq nimiq-blockchain remote denial of service via DHT record panic](https://junglewise.ai/threats/cve-2026-40092-nimiq-nimiq-blockchain-remote-denial-of-service-via-dht-record)