GO-2025-4239Published

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

cve-program · CVE-2025-68113

Published

altcha-lib

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "altcha-org",
                    "product": "altcha-lib",
                    "versions": [
                        {
                            "version": "< 1.4.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-203484

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 16, 2025, 12:53:59 AM

dateUpdated: Dec 16, 2025, 9:14:09 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-68113

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-115 · CWE-347

Original publisher date fields

published: 2025-12-16T01:15:53.383

lastModified: 2026-10-07T19:10:00.160

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-6gvq-jcmp-8959

Published

altcha-lib

npm

SEMVER · introduced 0 → fixed 1.4.1

altcha-org/altcha

Packagist

ECOSYSTEM · introduced 0 → fixed 1.3.1

11 explicitly affected versions

v0.1.0, v0.1.1, v0.1.2, v0.1.3, v0.1.4, v1.0.0, v1.1.0, v1.1.1, v1.1.2, v1.2.0, v1.3.0

github.com/altcha-org/altcha-lib-go

SEMVER · introduced 0 → fixed 1.0.0

org.altcha:altcha

Maven

ECOSYSTEM · introduced 0 → fixed 1.3.0

4 explicitly affected versions

1.1.0, 1.1.1, 1.1.2, 1.2.0

altcha

RubyGems

ECOSYSTEM · introduced 0 → fixed 1.0.0

3 explicitly affected versions

0.1.0, 0.2.0, 0.2.1

altcha

PyPI

ECOSYSTEM · introduced 0 → fixed 1.0.0

10 explicitly affected versions

0.1.0, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0

altcha

Hex

SEMVER · introduced 0 → fixed 1.0.0

2 explicitly affected versions

0.1.0, 0.2.0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2025-4239

Published

github.com/altcha-org/altcha-lib-go

SEMVER · introduced 0 → fixed 1.0.0

Original source record · Cite this exact observation · Complete original publisher JSON