PatchTheCVECVE-2025-54864: Hydra is a continuous integration service for Nix based projects
CVE-2025-54864 is a high-severity flaw (CVSS 7.5) affecting hydra. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2025-08-12 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-54864?
hydra: upgrade to 2025-08-12. Exact commands for each OS are on this page.
Is CVE-2025-54864 being exploited?
CVE-2025-54864 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-54864 affect?
CVE-2025-54864 affects hydra. Severity is high (CVSS 7.5). Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC sig
How urgent is CVE-2025-54864?
Priority 39/100. High severity; Remotely exploitable, no login, no user action
Software pages
GitHub vulnerabilities · Gitea vulnerabilities
Related CVEs
- CVE-2026-33504 HIGH 7.2 UPGRADE Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider
- CVE-2025-54800 MEDIUM 6.1 UPGRADE Hydra is a continuous integration service for Nix based projects
- CVE-2025-32435 LOW 2.6 UPGRADE Hydra is a Continuous Integration service for Nix based projects
- CVE-2024-45049 HIGH 7.5 UPGRADE Hydra is a Continuous Integration service for Nix based projects
- CVE-2024-32657 MEDIUM 4.6 UPGRADE Hydra is a Continuous Integration service for Nix based projects