CVE-2026-46369 nimiq CVE debrief

Who should care

Defenders responsible for systems using Nimiq version 1.5.0 or earlier should assess exposure and prioritize verification and remediation efforts. This includes reviewing system configurations, verifying Nimiq version, and updating to version 1.5.1 or later if necessary. Security teams and vulnerability management teams should also review the vulnerability and its potential impact on their systems.

Why it matters

This vulnerability allows a remote attacker to replay signed transactions, causing duplicate balance updates in the Nimiq Proof-of-Stake protocol implementation. Defenders should prioritize verifying exposure and assessing the impact on their systems, particularly those using Nimiq version 1.5.0 or earlier.

• Duplicate balance updates can occur due to replayed transactions
• Verification of Nimiq version and exposure is necessary
• Remediation requires updating to version 1.5.1 or later

Technical summary

The Nimiq Proof-of-Stake protocol implementation uses a strict lower-bound comparison that expires a stored transaction too early, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender and recipient balances to be updated twice. This vulnerability is fixed in version 1.5.1. The issue arises from the interaction between transaction validity and block window timing, impacting Nimiq version 1.5.0 or earlier. Defenders should prioritize verifying exposure and assessing impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, particularly those using Nimiq version 1.5.0 or earlier.

Recommended defensive actions

• Verify Nimiq version and assess exposure
• Update to version 1.5.1 or later
• Monitor for suspicious transactions
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The Nimiq Proof-of-Stake protocol implementation has a vulnerability that allows replay of signed transactions. Evidence is limited to CVE and NVD entries. Defenders should verify Nimiq version and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.