Quick answers
- Is CVE-2026-46369 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46369 being exploited in the wild.
- How severe is CVE-2026-46369?
- High severity, with a CVSS score of 7.5, published 26 August 2026.
- Which products and versions are affected?
- nimiq-blockchain (crates.io) <= 1.5.0, SEMVER:introduced=0,fixed=1.5.1.
- Is there a fix for CVE-2026-46369?
- Yes. nimiq-blockchain (crates.io): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-46369 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-46369?
- Check whether you run nimiq-blockchain (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- nimiq-blockchain (crates.io): upgrade to 1.5.1 or later
cargo update -p nimiq-blockchain
Technical details
An off-by-one error exists in the Nimiq blockchain's validity store logic. The store treats a transaction as 'in window' using a strict inequality check against the block number, which conflicts with the protocol's Transaction::is_valid_at logic. By carefully selecting the validity_start_height, an attacker can exploit a contiguous window of blocks (approximately 10 minutes on MainNet) where the replay-protection check fails. This allows a single signed transaction to be included in two different blocks, resulting in the sender being debited twice and the recipient credited twice. The issue is fixed in version 1.5.1.
Affected products
- Nimiq nimiq-blockchain <= 1.5.0
Identifiers
- CVE-2026-46369
- GHSA-3763-qp59-59vf
Timeline
- 2026-08-11: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched