GHSA-3763-qp59-59vf: High severity rust/nimiq-blockchain vulnerability
Impact The validity store treats a transaction with stored blocknumber = X as "in window" only when X > lastbn - transactionvaliditywindowblocks (strict inequality). However the protocol's Transaction::isvalidat accepts a transaction for inclusion in any block in [validitystartheight - blocksperbatch, validitystartheight + window - 1]. By choosing validitystartheight = X + blocksperbatch (the largest value still compatible with first inclusion at block X), an attacker can replay the same signed transaction in any block B such that X + window < B < validitystartheight + window, i.e., a contiguous window of blocksperbatch - 1 blocks (59 on MainNet, ~10 minutes) during which the replay-protection check fails to flag it. The same transaction is then executed twice: the sender is debited twice, the recipient credited twice.
Patches https://github.com/nimiq/core-rs-albatross/pull/3772
Workarounds No known workarounds
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/nimiq-blockchainto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
What is the severity of GHSA-3763-qp59-59vf?
The severity of GHSA-3763-qp59-59vf is classified as high, with a score of 7.5.
What software is affected by GHSA-3763-qp59-59vf?
GHSA-3763-qp59-59vf affects the rust/nimiq-blockchain software.
How do I fix GHSA-3763-qp59-59vf?
To fix GHSA-3763-qp59-59vf, upgrade to the latest version of the Nimiq blockchain that addresses this vulnerability.
What is the impact of GHSA-3763-qp59-59vf?
The impact of GHSA-3763-qp59-59vf includes potential validation issues that can allow transactions to be accepted incorrectly.
When was GHSA-3763-qp59-59vf published?
GHSA-3763-qp59-59vf was published on August 12, 2026.