All vulnerabilities
CVE-2026-46369GHSA-3763-qp59-59vf

nimiq-blockchain: Validity store off by one error

nimiq nimiq-blockchainrustLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.5.1Fixed versionGitHub
Published26 Aug 2026Updated 4 Oct 2026CVE List

What fixes it

  • 1.5.1nimiq-blockchain, rustGitHub
  • 1.5.1nimiq-blockchain, crates.ioOSVcargo update -p nimiq-blockchain --precise 1.5.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

The validity store treats a transaction with stored block_number = X as "in window" only when X > last_bn - transaction_validity_window_blocks (strict inequality). However the protocol's Transaction::is_valid_at accepts a transaction for inclusion in any block in [validity_start_height - blocks_per_batch, validity_start_height + window - 1]. By choosing validity_start_height = X + blocks_per_batch (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that X + window < B < validity_start_height + window, i.e., a contiguous window of blocks_per_batch - 1 blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.

Patches

https://github.com/nimiq/core-rs-albatross/pull/3772

Workarounds

No known workarounds

Text from GitHub Advisory Database

Affected versions 3

  • nimiq-blockchain, rust<= 1.5.0GitHub
  • core-rs-albatrossaffected: < 1.5.1CVE List
  • nimiq-blockchain, crates.iofrom first release, fixed in 1.5.1OSV

References 4