CVE-2026-46369: High severity rust/nimiq-blockchain vulnerability
Impact The validity store treats a transaction with stored blocknumber = X as "in window" only when X > lastbn - transactionvaliditywindowblocks (strict inequality). However the protocol's Transaction::isvalidat accepts a transaction for inclusion in any block in [validitystartheight - blocksperbatch, validitystartheight + window - 1]. By choosing validitystartheight = X + blocksperbatch (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that X + window < B < validitystartheight + window, i.e., a contiguous window of blocksperbatch - 1 blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.
Patches https://github.com/nimiq/core-rs-albatross/pull/3772
Workarounds No known workarounds
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/nimiq-blockchainto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46369?
CVE-2026-46369 has a severity rating of high with a score of 7.5.
How does CVE-2026-46369 affect transaction validity?
CVE-2026-46369 affects transaction validity by improperly allowing transactions to be considered valid when they should not be.
What is the impact of CVE-2026-46369 on the Nimiq blockchain?
The impact of CVE-2026-46369 on the Nimiq blockchain is that it can result in invalid transactions being accepted.
What software is affected by CVE-2026-46369?
CVE-2026-46369 affects the Nimiq blockchain software, specifically the rust/nimiq-blockchain implementation.
When was CVE-2026-46369 published?
CVE-2026-46369 was published on August 12, 2026.