CVE-2026-46369
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.39%
- CWE
- CWE-193, CWE-294
- Published
- 2026-08-26
- Last modified
- 2026-08-27
Affected products
- nimiq core-rs-albatross
Weakness type
Related vulnerabilities
- CVE-2026-81396 — Microsoft Excel Remote Code Execution Vulnerability
- CVE-2026-69609 — Win32k Information Disclosure Vulnerability
- CVE-2026-86297 — D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
- CVE-2026-81738 — OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an...
- CVE-2026-57160 — PJSIP: SIP message header buffer overflow
- CVE-2026-85454 — MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling
- CVE-2026-14368 — Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser
- CVE-2026-65927 — Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control