What’s Vulnerable › Products

input-output-hk hydra vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 0 published in the last 12 months.

Check whether your input-output-hk hydra version is affected

Latest input-output-hk hydra vulnerabilities

• CVE-2023-42449 — Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commits (CVSS 8.1)
• CVE-2023-42448 — Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadline (CVSS 8.1)
• CVE-2023-38701 — Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyone (CVSS 9.1)
• CVE-2023-42806 — Snapshot signature not including HeadID will allow replay attacks (CVSS 6.5)