CVE-2026-46369: falha de alta gravidade em nimiq core-rs-albatross
Nimiq: Validity store off by one error
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This issue is fixed in version 1.5.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
nimiq · core-rs-albatrossCVEs relacionadas — nimiq core-rs-albatross
No mesmo produto, das mais perigosas para as menos.
CVE-2025-47270HIGHnimiq-network-libp2p Uncontrolled Resource Consumption vulnerabilityEPSS 0.7%CVE-2026-40092HIGHnimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHTEPSS 0.6%CVE-2026-35468MEDIUMnimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history indexEPSS 0.5%CVE-2026-33184HIGHnimiq/core-rs-albatross: Discovery handshake limit could underflow and later provoke a deterministic overflow panicEPSS 0.5%CVE-2026-32605HIGHNimiq: Remote crash via off-by-one signer bounds check in proposal bufferEPSS 0.5%CVE-2026-54541LOWNimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keysEPSS 0.4%