{"id":"ghsa-ghsa-6jp4-8v48-cc5v","seq":2056910,"kind":"advisory","title":"Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it","url":"https://github.com/advisories/GHSA-6jp4-8v48-cc5v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6jp4-8v48-cc5v","summary":"影響: pip:electrum < 4.8.3 → 4.8.3\nThe main Electrum server the client connects to is trusted with mempool (\"unconfirmed\") transactions. This is documented [design](https://electrum.readthedocs.io/en/latest/faq.html#does-electrum-trust-servers). [0] However now someone figured out a way to practically exploit it: - when the client broadcasts a new tx1, a malicious server can swallow it, - and update the client's history with a conflicting (invalid) tx2 that replaces the outputs with the attacker's output address. - Tx2 has inval…","severity":"critical","techs":["python"],"cves":["CVE-2026-117601"],"tags":["GHSA-6jp4-8v48-cc5v","electrum"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:23:44.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}