WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor hyperledger✕Product fabric✕
Overview 6 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 1protected16.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 83.3% Withdrawn CVE 0 0.0%
Critical 1 16.7% High 4 66.7% Medium 1 16.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 5 83.3%
split by peak 2 / quarter
Not applicable: 5Protected by Waratek: 1 Medium: 1High: 4Critical: 1 not blocked: 5blocked by ARMR today: 1 No public exploit: 5Proof of concept only: 1
Q3 222 Not applicable2 High2 not blocked2 No public exploit2 Q4 221 Not applicable1 High1 not blocked1 No public exploit1 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 High1 not blocked1 No public exploit1 Q1 240 Q2 240 Q3 241 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 240 Q1 250 Q2 250 Q3 250 Q4 250 Q1 260 Q2 261 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1
Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-41586 Critical 2026-05-07 Protected by Waratek Proof of concept only Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
CVE-2024-45244 Medium 2024-08-25 Not applicable No public exploit Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.
CVE-2023-46132 High 2023-11-14 Not applicable No public exploit Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2022-45196 High 2022-11-12 Not applicable No public exploit Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft prevents exploitation via a locking mechanism and a check for names that already exist.
CVE-2022-36023 High 2022-08-18 Not applicable No public exploit Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.
CVE-2022-31121 High 2022-07-07 Not applicable No public exploit Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue.