Read the docs
TI-2020-08964 Aliases CVE-2020-11090GHSA-3gw4-m5w7-v89c

Uncontrolled Resource Consumption in Indy Node

Priority LOW 37CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.

Why it matters now

EPSS 0.02196 82nd percentileScored 2026-11-07
Fix Fixed indy-node (PyPI): 1.12.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
hyperledgerIndy Node= 1.12.2—No fix listedCNA
—indy-node (PyPI)1.12.2 to before 1.12.31.12.3Patch availableGHSA-3gw4-m5w7-v89c
  • Indy Node Vendorhyperledger Affected = 1.12.2 Fixed in — No fix listed CNA
  • indy-node (PyPI) Vendor— Affected 1.12.2 to before 1.12.3 Fixed in 1.12.3 Patch available GHSA-3gw4-m5w7-v89c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:indy-node:1.12.2:*:*:*:*:*:*:*1.12.2Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:indy-node:1.12.2:*:*:*:*:*:*:* Versions 1.12.2 Vulnerable ·backstage

Remediation

  • Fix · GHSA-3gw4-m5w7-v89c indy-node (PyPI) Fixed in 1.12.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11090
  2. 2026-10-03 Alias added: GHSA-3gw4-m5w7-v89c

References

Advisory 4

Other 3

  • TI-2026-30139 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE CVSS 4.0CRITICAL 9.3
  • TI-2024-14390 Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC CVSS 3.1CRITICAL 9.9
  • TI-2022-13066 Unlinkability broken in ursa when verifiers use malicious keys CVSS 3.1MEDIUM 5.3
  • TI-2022-16450 Incorrect Conversion between Numeric Types in Besu Ethereum Client CVSS 3.1CRITICAL 9.1
  • TI-2022-13065 Remote code execution in Indy's NODE_UPGRADE transaction CVSS 3.1HIGH 8.8
  • TI-2025-21486 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve CVSS 4.0HIGH 8.7
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences