# CVE-2026-46369: Nimiq nimiq-blockchain off-by-one error in validity store

Source: https://junglewise.ai/threats/cve-2026-46369-nimiq-nimiq-blockchain-off-by-one-error-in-validity-store  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-46369 · Severity: high · CVSS 7.5 · Published 2026-08-26

A flaw was discovered in the Nimiq blockchain software that allows an attacker to replay a previously processed transaction. This could result in a user being charged twice for the same payment while the recipient receives double the intended funds. The issue stems from a timing window where the system's built-in protection against duplicate transactions fails to recognize a repeat request.

Technologies: [nimiq-blockchain (crates.io)](https://junglewise.ai/threats/technologies/nimiq-blockchain). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-46369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46369 being exploited in the wild.

**How severe is CVE-2026-46369?** High severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** nimiq-blockchain (crates.io) <= 1.5.0, SEMVER:introduced=0,fixed=1.5.1.

**Is there a fix for CVE-2026-46369?** Yes. nimiq-blockchain (crates.io): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46369 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46369?** Check whether you run nimiq-blockchain (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nimiq-blockchain (crates.io): upgrade to 1.5.1 or later

  ```sh
  cargo update -p nimiq-blockchain
  ```


## Technical details

An off-by-one error exists in the Nimiq blockchain's validity store logic. The store treats a transaction as 'in window' using a strict inequality check against the block number, which conflicts with the protocol's Transaction::is_valid_at logic. By carefully selecting the validity_start_height, an attacker can exploit a contiguous window of blocks (approximately 10 minutes on MainNet) where the replay-protection check fails. This allows a single signed transaction to be included in two different blocks, resulting in the sender being debited twice and the recipient credited twice. The issue is fixed in version 1.5.1.

## Affected products

- Nimiq nimiq-blockchain <= 1.5.0

## Identifiers

- CVE-2026-46369
- GHSA-3763-qp59-59vf

## Timeline

- 2026-08-11: disclosed
- 2026-08-12: advisory
- 2026-08-12: patched

## References

- [https://api.github.com/users/viquezclaudio](https://api.github.com/users/viquezclaudio)
- [https://github.com/viquezclaudio](https://github.com/viquezclaudio)
- [https://api.github.com/users/viquezclaudio/gists%7B/gist_id%7D](https://api.github.com/users/viquezclaudio/gists%7B/gist_id%7D)
- [https://api.github.com/users/viquezclaudio/repos](https://api.github.com/users/viquezclaudio/repos)
- [https://avatars.githubusercontent.com/u/31874948?v=4](https://avatars.githubusercontent.com/u/31874948?v=4)
- [https://api.github.com/users/viquezclaudio/events%7B/privacy%7D](https://api.github.com/users/viquezclaudio/events%7B/privacy%7D)

## Related threats

- [Nimiq core-rs-albatross denial of service via RequestBatchSet panic](https://junglewise.ai/threats/cve-2026-46543-nimiq-core-rs-albatross-denial-of-service-via-requestbatchset)
- [nimiq-blockchain: Peer-triggerable panic during history sync](https://junglewise.ai/threats/cve-2026-34066-nimiq-blockchain-peer-triggerable-panic-during-history-sync)
- [Nimiq nimiq-blockchain missing upper bound on block timestamps](https://junglewise.ai/threats/cve-2026-40093-nimiq-nimiq-blockchain-missing-upper-bound-on-block-timestamps)