HIGH 7.5 GitHub
CVE-2026-46369
nimiq-blockchain: Validity store off by one error
### Impact
The validity store treats a transaction with stored `block_number = X` as "in window" only when `X > last_bn - transaction_validity_window_blocks` (strict inequality). However the protocol's `Transaction::is_valid_at` accepts a transaction for inclusion in any block in `[validity_start_height - blocks_per_batch, validity_start_height + window - 1]`. By choosing `validity_start_height = X + blocks_per_batch` (the largest value still compatible with first inclusion at block X), an attac
Affected Products
- rust/nimiq-blockchain <= 1.5.0
References
- https://github.com/advisories/GHSA-3763-qp59-59vf
- https://github.com/nimiq/core-rs-albatross/security/advisories/GHSA-3763-qp59-59vf
- https://github.com/nimiq/core-rs-albatross/pull/3772
- https://github.com/nimiq/core-rs-albatross/commit/a530b2434ebca6e3716f07c73079786fcc6f2e41
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-12 via GitHub. Affected: rust/nimiq-blockchain <= 1.5.0.
vulnfeed aggregates 10467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.