Read the docs
TI-2026-34086 Aliases CVE-2026-46369GHSA-3763-qp59-59vf

Nimiq: Validity store off by one error

Priority MEDIUM 40CWE-193Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-294.

Summary

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed core-rs-albatross (nimiq): 1.5.1nimiq-blockchain (crates.io): 1.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nimiqcore-rs-albatrossbefore 1.5.11.5.1Patch availableCNA
—nimiq-blockchain (crates.io)before 1.5.11.5.1Patch availableGHSA-3763-qp59-59vf
  • core-rs-albatross Vendornimiq Affected before 1.5.1 Fixed in 1.5.1 Patch available CNA
  • nimiq-blockchain (crates.io) Vendor— Affected before 1.5.1 Fixed in 1.5.1 Patch available GHSA-3763-qp59-59vf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:*——nimiq
  • cpe:2.3:a:nimiq:nimiq_proof-of-stake:*:*:*:*:*:*:*:* Versions — — ·nimiq

Remediation

  • Fix · CNA core-rs-albatross (nimiq) Fixed in 1.5.1
  • Fix · GHSA-3763-qp59-59vf nimiq-blockchain (crates.io) Fixed in 1.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46369
  2. 2026-10-03 Alias added: GHSA-3763-qp59-59vf

References

Other 4

  • TI-2026-26389 nimiq-account: Vesting insufficient funds error can panic CVSS 3.1HIGH 8.2
  • TI-2026-25867 nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation CVSS 3.1CRITICAL 9.6
  • TI-2026-28920 nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT CVSS 3.1HIGH 7.5
  • TI-2025-29800 nimiq-network-libp2p Uncontrolled Resource Consumption vulnerability CVSS 3.1HIGH 7.5
  • TI-2026-34224 nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item CVSS 3.1HIGH 7.5
  • TI-2026-34220 Nimiq network-libp2p: DHT query poisoning via first-record verification failure CVSS 3.1HIGH 7.5
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences