Layer-Two Scalability Solution Vulnerability in Cardano's Hydra
CVE-2025-48886

4.8MEDIUM

Key Information:

Vendor: Cardano-scaling
Status: Hydra
Vendor: CVE Published:; 19 June 2025

🔔 Create Cardano-scaling Vulnerability Alert

What is CVE-2025-48886?

Hydra, a layer-two scalability solution for Cardano, suffers from a vulnerability where it incorrectly assumes layer-one (L1) event finality. Specifically, it does not account for failed transactions on Cardano L1, which can expose the system to re-org attacks. Prior to version 0.22.0, nodes treated certain transactions as finalized upon recognition, leading to potential exploitation of the transaction flow. This issue has been addressed in version 0.22.0 through essential updates that enhance the integrity of state progression and transaction validation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch