Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/altcha-org/altcha-lib-go

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5GoAmendedPublished

    ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

    CVE-2025-68113 · GHSA-6gvq-jcmp-8959

    Affected
    • Go github.com/altcha-org/altcha-lib-go < 1.0.0
    Fixed in
    1.0.0· Vendor fix available
    Issue
    Impact A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. Patches This issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions. Workarounds As a mitigation, implementations may append a delimiter to the end of the salt value prior to HMAC computation (for example,…

    Recommended action: Upgrade to 1.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →