nimiq-blockchain: Validity store off by one error (CVE-2026-46369)
A vulnerability in nimiq-blockchain prior to version 1.5.1 allows replaying the same signed transaction multiple times within a specific block window due to an off-by-one error in the validity store's replay protection logic. This flaw causes the sender to be debited twice and the recipient credited twice for the same transaction.
AI Analysis
Technical Summary
The validity store in nimiq-blockchain treats a transaction with stored block_number = X as "in window" only when X > last_bn - transaction_validity_window_blocks (strict inequality). However, the protocol's Transaction::is_valid_at method accepts a transaction for inclusion in any block within a range that includes X, causing a mismatch. By selecting a validity_start_height = X + blocks_per_batch, an attacker can replay the same signed transaction in a contiguous window of blocks (blocks_per_batch - 1, which is 59 blocks on MainNet) where the replay-protection check fails. This results in the transaction being executed twice, debiting the sender and crediting the recipient twice. The vulnerability is tracked as CVE-2026-46369 and affects nimiq-blockchain versions prior to 1.5.1.
Potential Impact
An attacker can exploit this off-by-one error to replay a valid signed transaction multiple times within a specific block window, causing double spending where the sender loses funds multiple times and the recipient gains funds multiple times. This compromises transaction integrity and can lead to financial loss on the blockchain network.
Mitigation Recommendations
An official patch is available in nimiq-blockchain version 1.5.1 that fixes the off-by-one error in the validity store's replay protection logic. Users and operators should upgrade to version 1.5.1 or later to remediate this vulnerability. There are no known workarounds.
nimiq-blockchain: Validity store off by one error (CVE-2026-46369)
Description
A vulnerability in nimiq-blockchain prior to version 1.5.1 allows replaying the same signed transaction multiple times within a specific block window due to an off-by-one error in the validity store's replay protection logic. This flaw causes the sender to be debited twice and the recipient credited twice for the same transaction.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The validity store in nimiq-blockchain treats a transaction with stored block_number = X as "in window" only when X > last_bn - transaction_validity_window_blocks (strict inequality). However, the protocol's Transaction::is_valid_at method accepts a transaction for inclusion in any block within a range that includes X, causing a mismatch. By selecting a validity_start_height = X + blocks_per_batch, an attacker can replay the same signed transaction in a contiguous window of blocks (blocks_per_batch - 1, which is 59 blocks on MainNet) where the replay-protection check fails. This results in the transaction being executed twice, debiting the sender and crediting the recipient twice. The vulnerability is tracked as CVE-2026-46369 and affects nimiq-blockchain versions prior to 1.5.1.
Potential Impact
An attacker can exploit this off-by-one error to replay a valid signed transaction multiple times within a specific block window, causing double spending where the sender loses funds multiple times and the recipient gains funds multiple times. This compromises transaction integrity and can lead to financial loss on the blockchain network.
Mitigation Recommendations
An official patch is available in nimiq-blockchain version 1.5.1 that fixes the off-by-one error in the validity store's replay protection logic. Users and operators should upgrade to version 1.5.1 or later to remediate this vulnerability. There are no known workarounds.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3763-qp59-59vf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-46369"]
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7c9b2dbf8831d539cdb66f
Added to database: 08/12/2026, 16:11:25 UTC
Last enriched: 08/12/2026, 16:21:52 UTC
Last updated: 08/13/2026, 00:18:38 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.