GHSA-h9cc-w26m-j342

Source

https://github.com/advisories/GHSA-h9cc-w26m-j342

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h9cc-w26m-j342/GHSA-h9cc-w26m-j342.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h9cc-w26m-j342

Aliases

CVE-2026-46542

Published

2026-05-21T19:45:08Z

Modified

2026-06-10T13:45:15Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator

Summary

nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points

Details

Impact

A denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process.

A secondary panic existed in Commitment::From<[u8; 32]>, which similarly called .unwrap() on a failing curve point decompression.

Who is affected: Browser and desktop wallet users of the web-client WASM library and the nimiq-wallet crate, when initiating a multisig operation with an attacker-supplied public key. An attacker must convince the user to include a crafted public key in a multisig setup — this is not a remotely triggerable node/validator crash.

Who is NOT affected: Validator nodes, consensus, blockchain, mempool, and networking code. There is no on-chain multisig account type; multisig is a purely client-side construct, and no validator/consensus code calls the multisig delinearization path.

Patches

See PR.

Workarounds

No code-level workaround exists short of the patch. Users of wallet applications can mitigate exposure by only performing multisig operations with public keys received from trusted sources.

Resources

Affected code: keys/src/multisig/mod.rs, keys/src/multisig/commitment.rs

Database specific

{
    "cwe_ids": [
        "CWE-617"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-21T19:45:08Z",
    "nvd_published_at": "2026-06-10T00:16:54Z",
    "severity": "MODERATE"
}

References

Affected packages

crates.io / nimiq-keys

Package

Name: nimiq-keys; View open source insights on deps.dev
Purl: pkg:cargo/nimiq-keys

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h9cc-w26m-j342/GHSA-h9cc-w26m-j342.json"