275 matches found
EUVD-2026-35139
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...
org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)
org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...
Hyperledger Fabric Chaincode Java log information leakage vulnerability
Hyperledger Fabric Chaincode Java is an open-source Java-based smart contract development framework developed by the Hyperledger project. In versions 2.3.1 to 2.5.10 of Hyperledger Fabric Chaincode Java, there was a vulnerability involving log information leakage. This vulnerability occurred when...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
org.devocative.thallo:thallo-starter-fabric-chaincode (1.0) potentially affected by CVE-2026-45581 via org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim (2.4.1)
org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim and may be impacted: -...
BIT-HYPERLEDGER-FABRIC-PEER-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
Deserialization Of Untrusted Data
org.hyperledger.fabric-sdk-java, fabric-sdk-java is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Channel.java implementing readObject and exposing deSerializeChannel, which invoke ObjectInputStream.readObject on untrusted byte arrays without configuring an...
com.baoquan:verax-sdk (1.0.0), com.easypayx:easypay-blockchain-java-sdk (>=1.0.0, <=1.0.4) +21 more potentially affected by CVE-2026-41586 via org.hyperledger.fabric-sdk-java:fabric-sdk-java (>=1.0.1, <=2.2.26)
org.hyperledger.fabric-sdk-java:fabric-sdk-java MAVEN version =1.0.1, =1.0.0, =1.0.0-release, =1.0.0-release, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =3.16.1, =1.2.0, =1.3.0, =0.10.1, =014.1 and more Source cves: CVE-2026-41586 Source advisory: SNYK:JAVA-ORGHYPERLEDGERFABRICSDKJAVA-16439197...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
EUVD-2026-28316
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
CVE-2026-41586: Deserialization of Untrusted Data
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
Hyperledger Fabric code issues and vulnerabilities
Hyperledger Fabric is an enterprise-level, open-source distributed ledger framework developed by the Hyperledger project. It is used for developing solutions and applications. Versions of Hyperledger Fabric from 1.0.0 to 2.2.26 contained code vulnerabilities that could lead to remote code...
PT-2026-37132
Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions 1.0.0 through 2.2.26 Description In the deprecated fabric-sdk-java client SDK, the Channel.java file implements readObject and exposes the deSerializeChannel function, both of which call ObjectInputStream.readObject...
CVE-2022-31021
Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds implementations is that the Issuer does not publish a key correctness proof demonstrating that a generated private key is sufficient to...
CVE-2022-31121
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error ...
EUVD-2018-0149
Malware in sbrugna...
EUVD-2021-2543
Malware in sbrugna...