xrpld 3.4.1 vulnerability disclosure report

XRPL published the vulnerability disclosure report for xrpld 3.4.1, describing the two vulnerabilities fixed in that version. The first is a missing validation for wrapping internal transactions in a Batch—the server did not check whether the inner transaction was wrapped in the RawTransaction field, which could cause different node versions to disagree on whether the same transaction is valid; the fix was enabled on Mainnet on 2026-10-09 in the form of the fixBatchV1_2 amendment. The second is a 64-bit integer overflow in the payment engine, where an attacker could mint XRP out of thin air using hundreds of offers plus one payment; this flaw has existed since the payment engine was written in 2015, and the fix shipped with 3.4.1 on 2026-09-25 and took effect immediately, without going through the amendment process. The report states that no exploitation of this vulnerability was found on any public network.