https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 13:40:16 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-46369 <p>Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.</p> <p>Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-46369 https://vulnerability.circl.lu/vuln/ghsa-3763-qp59-59vf <p><strong>Affected:</strong> crates.io: nimiq-blockchain</p> <p>### Impact The validity store treats a transaction with stored `block_number = X` as &#34;in window&#34; only when `X &gt; last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol&#39;s `Transaction::is_valid_at` accepts a transaction for inclusion in any block in `[validity_start_height - blocks_per_batch, validity_start_height + window - 1]`. By choosing `validity_start_height = X + blocks_per_batch` (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that `X + window &lt; B &lt; validity_start_height + window`, i.e., a contiguous window of `blocks_per_batch - 1` blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.</p> <p>### Patches https://github.com/nimiq/core-rs-albatross/pull/3772</p> <p>### Workarounds No known workarounds</p> <p><strong>Affected:</strong> crates.io: nimiq-blockchain</p> <p>### Impact The validity store treats a transaction with stored `block_number = X` as &#34;in window&#34; only when `X &gt; last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol&#39;s `Transaction::is_valid_at` accepts a transaction for inclusion in any block in `[validity_start_height - blocks_per_batch, validity_start_height + window - 1]`. By choosing `validity_start_height = X + blocks_per_batch` (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that `X + window &lt; B &lt; validity_start_height + window`, i.e., a contiguous window of `blocks_per_batch - 1` blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.</p> <p>### Patches https://github.com/nimiq/core-rs-albatross/pull/3772</p> <p>### Workarounds No known workarounds</p> https://vulnerability.circl.lu/vuln/ghsa-3763-qp59-59vf