CVE-2024-45244

Hyperledger Fabric does not verify request has a timestamp within the expected time window

5.3 MediumPublic exploitFix available

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.59%Up 0.5 points since Aug 25, 2024

What each source reports

NVD Score used 5.3

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: CVE-2024-45244
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-294
Updated: 2026-11-02

CVE List 5.3

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: CVE-2024-45244
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-294
Updated: 2026-11-02

EUVDEUVD-2024-2485 5.3

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: EUVD-2024-2485
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-48gg-32q2-4r6m 5.3

Hyperledger Fabric does not verify request has a timestamp within the expected time window

Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window.

Record: GHSA-48gg-32q2-4r6m
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-285, CWE-294, CWE-672
Updated: 2026-11-02

OSV 5.3

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: CVE-2024-45244
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-48gg-32q2-4r6m 5.3

Hyperledger Fabric does not verify request has a timestamp within the expected time window

Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window.

Record: GHSA-48gg-32q2-4r6m
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-285, CWE-294, CWE-672
Updated: 2026-11-02

Show 4 moreShow less

OSVBIT-hyperledger-fabric-orderer-2024-45244 No score

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: BIT-hyperledger-fabric-orderer-2024-45244
Updated: 2026-11-02

OSVBIT-hyperledger-fabric-peer-2024-45244 No score

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: BIT-hyperledger-fabric-peer-2024-45244
Updated: 2026-11-02

OSVBIT-hyperledger-fabric-tools-2024-45244 No score

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

Record: BIT-hyperledger-fabric-tools-2024-45244
Updated: 2026-11-02

OSVGO-2024-3099 No score

Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric

Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric

Record: GO-2024-3099
Updated: 2026-11-02

Affected products

hyperledger fabric

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hyperledger/fabric` Go	through 2.5.9	None known
`hyperledger-fabric-orderer` Bitnami	before 2.5.10	2.5.10
`hyperledger-fabric-peer` Bitnami	before 2.5.10	2.5.10
`hyperledger-fabric-tools` Bitnami	before 2.5.10	2.5.10
`github.com/hyperledger/fabric` Go	All versions	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	shanker-sec/HLF_TxTime_spoofing	2024-06-23
PoC in GitHub	shanker-sec/hlf-time-oracle	2024-07-28

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45244 is a medium vulnerability (CVSS 5.3) in Hyperledger Fabric, published August 25, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in hyperledger-fabric-orderer 2.5.10.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

Public exploits

History

In short

References