Hyperledger vulnerabilities
We track 9 vulnerabilities in Hyperledger products across 7 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on May 7, 2026.
Latest Hyperledger vulnerabilities
- 9.8 Critical severity
fabric: Deserialization of Untrusted Data
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.rea
- 8.7 High severity
besu-native: Missing Cryptographic Step
Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 through 25.2.2, corresponding to besu-native versions 0.9.0 through 1.2.1, have a potential consensus bug
- 8.1 High severity
ursa: Use of a Broken or Risky Cryptographic Algorithm
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a maliciou
- 8.8 High severity
aries-cloudagent-python: Improper Verification of Cryptographic Signature
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), th
- 7.5 High severity
Fabric: Always-Incorrect Control Flow Implementation
Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names
- 9.1 Critical severity
besu: Incorrect Conversion between Numeric Types
Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations (
- 7.5 High severity
indy-node: Uncontrolled Resource Consumption
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable t
- 8.8 High severity
Indy Node is the server portion of a distributed ledger purpose-built for decentralized…
Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within
- 7.5 High severity
Hyperledger Fabric is a permissioned distributed ledger framework.
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing con