Vulnerabilities

TI-2026-38699 CVE-2026-53658 · GHSA-xghw-p77p-3r7x

Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter

LOW 34

Fabric CA is a Certificate Authority for Hyperledger Fabric.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0045 Published 2026-09-15 Fixed in 1.5.21 CWE-90

TI-2026-33330 CVE-2026-45581 · GHSA-wg5x-3g47-v38r

fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Mode

LOW 24

fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00106 Published 2026-06-08 Fixed in 2.5.10 CWE-532

TI-2026-30139 CVE-2026-41586 · GHSA-prf8-cf2x-rhx7

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

HIGH 81

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0053 Published 2026-05-07 No fix listed CWE-502

TI-2025-21486 CVE-2025-30147

ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve

MEDIUM 43

Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00288 Published 2025-05-07 Fixed in 1.3.0 CWE-325

TI-2024-30320 CVE-2024-45244 · GHSA-48gg-32q2-4r6m

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has…

LOW 31

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00589 Published 2024-08-25 No fix listed CWE-294

TI-2024-14785 CVE-2024-22192 · GHSA-6698-mhxx-r84g

Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders

LOW 29

Ursa is a cryptographic library for use with blockchains.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00317 Published 2024-01-16 Fixed in 0.1.0 CWE-327

TI-2024-14391 CVE-2024-21670 · GHSA-r78f-4q2q-hvv4

Broken or risky cryptographic algorithm in hyperledger-archives ursa

LOW 37

Ursa is a cryptographic library for use with blockchains.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00276 Published 2024-01-16 No fix listed CWE-327

TI-2022-13066 CVE-2022-31021 · GHSA-2q6j-gqc4-4gw3

Unlinkability broken in ursa when verifiers use malicious keys

MEDIUM 57

Ursa is a cryptographic library for use with blockchains.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00428 Published 2024-01-16 No fix listed CWE-829

TI-2024-14390 CVE-2024-21669 · GHSA-97x9-59rv-q5pm

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

HIGH 76

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00632 Published 2024-01-11 Fixed in 0.10.5, 0.11.0 CWE-347

TI-2023-24774 CVE-2023-46132 · GHSA-v9w2-543f-h69m

Crosslinking transaction attack in hyperledger/fabric

LOW 32

Hyperledger Fabric is an open source permissioned distributed ledger framework.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00519 Published 2023-11-14 Fixed in 2.2.14, 2.5.5 CWE-362

TI-2022-22261 CVE-2022-45196 · GHSA-wp68-67c6-87fh

Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by…

LOW 34

Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00867 Published 2022-11-12 No fix listed CWE-670

TI-2022-16450 CVE-2022-36025 · GHSA-4456-w38r-m53x

Incorrect Conversion between Numeric Types in Besu Ethereum Client

MEDIUM 47

Besu is a Java-based Ethereum client.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01053 Published 2022-09-24 Fixed in 22.7.1 CWE-196

TI-2022-13052 CVE-2022-31006 · GHSA-x996-7qh9-7ff7

Hyperledger Indy DOS vulnerability

MEDIUM 41

indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01155 Published 2022-09-09 No fix listed CWE-400

TI-2022-13065 CVE-2022-31020 · GHSA-r6v9-p59m-gj2p

Remote code execution in Indy's NODE_UPGRADE transaction

MEDIUM 44

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02308 Published 2022-09-06 Fixed in 1.12.5rc1 CWE-20

TI-2022-16448 CVE-2022-36023 · GHSA-qj6r-fhrc-jj5r

Remote denial of service in Hyperledger Fabric Gateway

LOW 33

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.01159 Published 2022-08-18 Fixed in 2.4.6 CWE-20

TI-2022-13165 CVE-2022-31121 · GHSA-72x4-cq6r-jp4p

Improper Input Validation in fabric hyperledger

MEDIUM 43

Hyperledger Fabric is a permissioned distributed ledger framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02136 Published 2022-07-07 Fixed in 2.2.7, 2.4.5 CWE-20

TI-2021-18104 CVE-2021-41272

SHL, SHR, and SAR operations trigger native exception at key values in besu

LOW 36

Besu is an Ethereum client written in Java.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01464 Published 2021-12-13 No fix listed CWE-681

TI-2021-04468 CVE-2021-21369

Potential DoS in Besu HTTP JSON-RPC API

LOW 32

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01668 Published 2021-03-09 Fixed in 1.5.1 CWE-400

TI-2020-08966 CVE-2020-11093 · GHSA-wh2w-39f4-rpv2

Authorization bypass in Hyperledger Indy

LOW 35

Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01183 Published 2020-12-24 Fixed in 1.12.4 CWE-347

TI-2020-08964 CVE-2020-11090 · GHSA-3gw4-m5w7-v89c

Uncontrolled Resource Consumption in Indy Node

LOW 37

In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02196 Published 2020-06-11 Fixed in 1.12.3 CWE-400

TI-2018-02752 CVE-2018-3756 · GHSA-jmw4-vrcr-pppg

Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and…

LOW 34

Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or bloc…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00803 Published 2018-06-01 No fix listed CWE-347

Vulnerabilities

Filters