Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

nimiq-keys

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3crates.ioPublished

    nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points

    CVE-2026-46542 · GHSA-h9cc-w26m-j342

    Affected
    • crates.io nimiq-keys < 1.4.0
    Fixed in
    1.4.0· Vendor fix available
    Issue
    Impact A denial-of-service vulnerability exists in the Ed25519 multisig delinearization code path. Ed25519PublicKey::delinearize() in keys/src/multisig/mod.rs called .unwrap() on curve point decompression, which panics when a public key is constructed from 32 bytes that do not represent a valid point on the Ed25519 curve. Ed25519PublicKey construction only validates byte length, not curve membership, so invalid keys can reach the delinearization path and crash the hosting process. A secondary panic existed in Commitment::From<[u8; 32], which similarly called .unwrap() on a failing curve point decompression. Who is affected: Browser and desktop wallet users of the web-client WASM library and the nimiq-wallet crate, when initiating a multisig operation with an attacker-supplied public key. An attacker must convince the user to include a crafted public key in a multisig setup — this is not a remotely triggerable node/validator crash. Who is NOT affected: Validator nodes, consensus,…

    Recommended action: Upgrade to 1.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →