altcha
A lightweight library for creating and verifying ALTCHA challenges.
Activity
- Latest release
- 1mo ago
- Total releases
- 7
- Cadence
- ~2 months
- Last 12 months
- 4
Details
- License
- MIT
- First release
- Aug 03, 2024
| Version | Released | |
|---|---|---|
2.0.1
patch
|
2.0.1
patch
Dependencies (4)
|
|
2.0.0
major
|
2.0.0
major
Dependencies (4)
|
|
2.0.0.beta1
pre
|
2.0.0.beta1
pre
Dependencies (4)
|
|
1.0.0
major
|
1.0.0
major
Dependencies (3)
|
|
0.2.1
patch
1 CVE
CVE-2025-68113
GHSA-6gvq-jcmp-8959
GO-2025-4239
PYSEC-2026-1115
Dec 16, 2025
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
Low
ImpactA cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. PatchesThis issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions. WorkaroundsAs a mitigation, implementations may append a delimiter to the end of the Affected versions
0.1.0
0.2.0
0.2.1
Fixed in
1.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.2.1
patch
Dependencies (3)
|
|
0.2.0
minor
1 CVE
CVE-2025-68113
GHSA-6gvq-jcmp-8959
GO-2025-4239
PYSEC-2026-1115
Dec 16, 2025
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
Low
ImpactA cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. PatchesThis issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions. WorkaroundsAs a mitigation, implementations may append a delimiter to the end of the Affected versions
0.1.0
0.2.0
0.2.1
Fixed in
1.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.2.0
minor
Dependencies (3)
|
|
0.1.0
initial
1 CVE
CVE-2025-68113
GHSA-6gvq-jcmp-8959
GO-2025-4239
PYSEC-2026-1115
Dec 16, 2025
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
6.5
/ 10
Medium
Network
Low
None
None
Unchanged
None
Low
Low
ImpactA cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind challenge parameters to the nonce, allowing an attacker to reinterpret a valid proof-of-work submission with a modified expiration value. This may allow previously solved challenges to be reused beyond their intended lifetime, depending on server-side replay handling and deployment assumptions. The vulnerability primarily impacts abuse-prevention mechanisms such as rate limiting and bot mitigation. It does not directly affect data confidentiality or integrity. PatchesThis issue has been addressed by enforcing explicit semantic separation between challenge parameters and the nonce during HMAC computation. Users are advised to upgrade to patched versions. WorkaroundsAs a mitigation, implementations may append a delimiter to the end of the Affected versions
0.1.0
0.2.0
0.2.1
Fixed in
1.0.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
0.1.0
initial
Dependencies (3)
|