CVE-2023-42448

Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.

• CWE-20
• CWE-1284

• https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03Release Notes
• https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296Product
• https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323Product
• https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1fPatch
• https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996Vendor Advisory
• https://github.com/input-output-hk/hydra/blob/master/CHANGELOG.md#0130---2023-10-03Release Notes
• https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L284-L296Product
• https://github.com/input-output-hk/hydra/blob/master/hydra-plutus/src/Hydra/Contract/Head.hs#L320-L323Product
• https://github.com/input-output-hk/hydra/commit/2f45529729e28254a62f7a7c8d6649066923ed1fPatch
• https://github.com/input-output-hk/hydra/security/advisories/GHSA-mgcx-6p7h-5996Vendor Advisory

Published

Oct 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42442JumpServer is an open source bastion host and a professional…5.3
• CVE-2023-42443Vyper is a Pythonic Smart Contract Language for the Ethereum…8.1
• CVE-2023-42444phonenumber is a library for parsing, formatting and validat…7.5
• CVE-2023-42445Gradle is a build tool with a focus on build automation and …5.3
• CVE-2023-42446Pow is a authentication and user management solution for Pho…6.5
• CVE-2023-42447blurhash-rs is a pure Rust implementation of Blurhash, softw…7.5
• CVE-2023-42449Hydra is the two-layer scalability solution for Cardano. Pri…8.1
• CVE-2023-4245The WooCommerce PDF Invoice Builder for WordPress is vulnera…4.3
• CVE-2023-42450Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42451Mastodon is a free, open-source social network server based …7.5
• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3