CVE-2025-48886

Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those events as finalized as soon as they are recognized by the node participants making such transactions the target of re-org attacks. The system does not currently consider the fact that failed transactions on the Cardano L1 can indeed appear in blocks because these transactions are so infrequent. This issue has been patched in version 0.22.0.

• CWE-755

• https://github.com/cardano-scaling/hydra/commit/2bc6a82ef6dbfa8b94e1c11d55253713065f605e
• https://github.com/cardano-scaling/hydra/commit/fb22d968964bf5d5b79227cc845d871147044ce7
• https://github.com/cardano-scaling/hydra/security/advisories/GHSA-qr9f-mpgf-wp25

Published

Jun 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48880FreeScout is a free self-hosted help desk and shared mailbox…6.6
• CVE-2025-48881Valtimo is a platform for Business Process Automation. In ve…8.3
• CVE-2025-48882PHPOffice Math is a library that provides a set of classes t…8.7
• CVE-2025-48883Chrome PHP allows users to start playing with chrome/chromiu…5.3
• CVE-2025-48884Galette is a membership management web application for non p…6.1
• CVE-2025-48885application-urlshortener create shortened URLs for XWiki pag…5.7
• CVE-2025-48887vLLM, an inference and serving engine for large language mod…6.5
• CVE-2025-48888Deno is a JavaScript, TypeScript, and WebAssembly runtime. S…5.3
• CVE-2025-48889Gradio is an open-source Python package that allows quick bu…7.5
• CVE-2025-4889A vulnerability has been found in code-projects Tourism Mana…7.8
• CVE-2025-48890WRH-733GBK and WRH-733GWH contain an improper neutralization…9.8
• CVE-2025-48891A vulnerability exists in Advantech iView that could allow f…7.6