Hyperledger vulnerabilities

Products

• Fabric 7
• Besu 3
• Indy-node 3
• Ursa 3

Newest

• hyperledger fabric-ca Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter CVE-2026-53658 Fix available 6.3 MediumAugust 14, 2026
• hyperledger fabric-chaincode-java fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode CVE-2026-45581 Fix available 5.5 MediumMay 19, 2026
• hyperledger fabric ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVE-2026-41586 Fix available 9.3 CriticalApril 29, 2026
• axiomthemes fabric WordPress Fabric theme <= 1.5.0 - Local File Inclusion vulnerability CVE-2025-58941 8.1 HighDecember 18, 2025
• hyperledger besu-native ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVE-2025-30147 8.7 HighMay 7, 2025
• hyperledger fabric Hyperledger Fabric does not verify request has a timestamp within the expected time window CVE-2024-45244 Public exploitFix available 5.3 MediumAugust 25, 2024
• hyperledger ursa CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential CVE-2024-21670 Fix available 6.5 MediumJanuary 16, 2024
• hyperledger ursa Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders CVE-2024-22192 Fix available 6.5 MediumJanuary 16, 2024
• hyperledger ursa Unlinkability broken in ursa when verifiers use malicious keys CVE-2022-31021 Fix available 3.3 LowJanuary 16, 2024
• hyperledger aries cloud agent, aries-cloudagent-python +1 more Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVE-2024-21669 Fix available 9.9 CriticalJanuary 9, 2024
• hyperledger fabric Crosslinking transaction attack in hyperledger/fabric CVE-2023-46132 Fix available 7.1 HighNovember 14, 2023
• hyperledger fabric Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by... CVE-2022-45196 Fix available 7.5 HighNovember 12, 2022
• hyperledger besu Incorrect Conversion between Numeric Types in Besu Ethereum Client CVE-2022-36025 Fix available 9.1 CriticalSeptember 23, 2022
• hyperledger indy-node Hyperledger Indy DOS vulnerability CVE-2022-31006 Fix available 7.5 HighSeptember 9, 2022
• hyperledger indy-node Remote code execution in Indy's NODE_UPGRADE transaction CVE-2022-31020 Fix available 8.8 HighSeptember 2, 2022
• hyperledger fabric Remote denial of service in Hyperledger Fabric Gateway CVE-2022-36023 Fix available 7.0 HighAugust 18, 2022
• hyperledger fabric Improper Input Validation in fabric hyperledger CVE-2022-31121 Fix available 7.5 HighJuly 7, 2022
• hyperledger besu SHL, SHR, and SAR operations trigger native exception at key values in besu CVE-2021-41272 7.5 HighDecember 13, 2021
• hyperledger besu Potential DoS in Besu HTTP JSON-RPC API CVE-2021-21369 6.5 MediumMarch 9, 2021
• hyperledger indy-node Authorization bypass in Hyperledger Indy CVE-2020-11093 Fix available 7.5 HighDecember 24, 2020
• hyperledger indy node, linuxfoundation indy-node +1 more Uncontrolled Resource Consumption in Indy Node CVE-2020-11090 Fix available 7.5 HighJune 11, 2020
• hyperledger iroha Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block... CVE-2018-3756 7.5 HighJune 1, 2018