p PatchFirst

CVE-2026-117603

CVE-2026-117603 · Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent pay_invoice requests that pass budget_allows_spend() before add_to_budget() runs, or repeatedly pay msat amounts that are floored to whole satoshis, to drain funds beyond the limit.

CVSS 9.3 · Critical · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • electrum

    Versions
    • ≥ 0, < 4.7.2: Affected (semver)
    • 4.7.2: Not affected (semver)

    Update to 4.7.2

  • electrum Debian:12

    Versions
    • 4.3.4+dfsg1-1
    • 4.3.4+dfsg1-1+deb12u1
    • 4.4.5+dfsg1-1
    • 4.4.5+dfsg1-1~bpo12+1
    • 4.4.5+dfsg1-2
    • 4.4.5+dfsg1-3
    • 4.4.5+dfsg1-3~bpo12+1
    • 4.4.6+dfsg-1
    • 4.4.6+dfsg-1~bpo12+1
    • 4.4.6+dfsg2-1
    • 4.4.6+dfsg2-1~bpo12+1
    • 4.5.2+dfsg-1
    • 4.5.2+dfsg-2
    • 4.5.2+dfsg-2~bpo12+1
    • 4.5.4+dfsg-1
    • 4.5.4+dfsg-1~bpo12+1
    • 4.5.4+dfsg-2
    • 4.5.4+dfsg-3
    • 4.5.4+dfsg-3~bpo12+1
    • 4.5.5+dfsg-1
    • 4.5.5+dfsg-1~bpo12+1
    • 4.5.5+dfsg-2
    • 4.5.5+dfsg-3
    • 4.5.5+dfsg-4
    • 4.5.5+dfsg-4~bpo12+1
    • 4.5.8+ds-1
    • 4.5.8+ds-1~bpo12+1
    • 4.5.8+ds-2
    • 4.5.8+ds-3
    • 4.5.8+ds-3~bpo12+1
    • 4.5.8+ds-4
    • 4.5.8+ds-5
    • 4.5.8+ds-5~bpo12+1
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    • 4.7.2+dfsg-2
    • 4.8.1+dfsg-1
    • 4.8.1+dfsg-1~bpo13+1
    • 4.8.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • electrum Debian:13

    Versions
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    • 4.7.2+dfsg-2
    • 4.8.1+dfsg-1
    • 4.8.1+dfsg-1~bpo13+1
    • 4.8.3+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • electrum Debian:14

    Versions
    • 4.5.8+ds-6
    • 4.5.8+ds-7
    • 4.5.8+ds-8
    • 4.6.2+dfsg-1
    • 4.6.2+dfsg-2
    • 4.6.2+dfsg-2~bpo13+1
    • 4.7.0+dfsg-1
    • 4.7.0+dfsg-1~bpo13+1
    • 4.7.0+dfsg2-1
    • 4.7.1+dfsg-1
    • 4.7.2+dfsg-1
    • 4.7.2+dfsg-1~bpo13+1
    • 4.7.2+dfsg-2
    • 4.8.1+dfsg-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 4.8.1+dfsg-1

    Update to 4.8.1+dfsg-1

Original sources

Check your server →