PT-2025-26219 · Hydra · Hydra

Colll78 · Published 2025-06-19 · Updated 2025-06-19 · CVE-2025-48886

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hydra versions prior to 0.22.0

Description Hydra is a layer-two scalability solution for Cardano. The issue arises from the assumption of L1 event finality, where the system does not consider failed transactions on the Cardano L1. This makes transactions a target for re-org attacks as soon as they are recognized by node participants. The system's oversight of failed transactions appearing in blocks, due to their infrequency, contributes to the problem.

Recommendations For versions prior to 0.22.0, update to version 0.22.0 to resolve the issue.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2025-48886

GHSA-QR9F-MPGF-WP25

Affected Products

Hydra

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48886.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-48886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48886 · Security Note
• https://github.com/cardano-scaling/hydra/commit/2bc6a82ef6dbfa8b94e1c11d55253713065f605e · Note
• https://github.com/cardano-scaling/hydra/security/advisories/GHSA-qr9f-mpgf-wp25 · Note
• https://github.com/cardano-scaling/hydra/commit/fb22d968964bf5d5b79227cc845d871147044ce7 · Note
• https://t.me/cvetracker/26571 · Telegram Post
• https://t.me/cvenotify/126164 · Telegram Post
• https://twitter.com/CVEnew/status/1935723246579790017 · Twitter Post