CVE-2026-46369

Name of the Vulnerable Software and Affected Versions Nimiq versions prior to 1.5.1

Description The validity store uses a strict lower-bound comparison that expires stored transactions too early relative to the Transaction::is valid at function. This occurs because the store treats a transaction with block number = X as being within the window only when X > last bn - transaction validity window blocks. A remote attacker can exploit this by choosing a specific validity start height to replay a signed transaction within a window of blocks per batch minus one block. This results in the transaction being executed twice, causing the sender to be debited twice and the recipient to be credited twice.

Recommendations Update to version 1.5.1.