[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftqAGMOKEyJLgNpR4s5ubR1Vw-F8qQXsVyRueR5w9mbM":3,"g5a-risk:CVE-2025-54864":109},{"success":4,"data":5,"meta":106},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":31,"epssPercentile":26,"epssTimeSeries":32,"severity":33,"affectedProducts":34,"affectedProductsCount":40,"references":41,"referencesCount":51,"weaknesses":52,"weaknessesCount":40,"isActivelyExploited":61,"cisaInfo":26,"otxData":26,"relatedBlogPosts":62,"seoMetadata":63,"configurations":88,"relatedVendorCves":97,"notableEvents":98},"CVE-2025-54864","What is CVE-2025-54864?","Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, \u002Fapi\u002Fpush-github and \u002Fapi\u002Fpush-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking \u002Fapi\u002Fpush-github and \u002Fapi\u002Fpush-gitea via a reverse proxy.","Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, \u002Fapi\u002Fpush-github and \u002Fapi\u002Fpush-gitea are called by the correspondi...","2025-08-12T16:15:28.337","2025-09-22T14:58:23.957",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":29,"CVSSMetricV2":30,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,[],[],0.00382,[31,31,31,31,31,31,31],"High",[35],{"vendor":36,"product":37,"version":38,"criteria":39,"vulnerable":4},"nixos","hydra","*","cpe:2.3:a:nixos:hydra:*:*:*:*:*:*:*:*",1,[42,47],{"url":43,"source":44,"tags":45},"https:\u002F\u002Fgithub.com\u002FNixOS\u002Fhydra\u002Fcommit\u002Ff7bda020c6144913f134ec616783e57817f7686f","GitHub",[46],"Patch",{"url":48,"source":44,"tags":49},"https:\u002F\u002Fgithub.com\u002FNixOS\u002Fhydra\u002Fsecurity\u002Fadvisories\u002FGHSA-qpq3-646c-vgx9",[50,46],"Vendor Advisory",2,[53],{"id":54,"name":55,"description":56,"extendedDescription":57,"status":58,"abstraction":59,"structure":60},"CWE-306","Missing Authentication for Critical Function","The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","","Draft","Base","Simple",false,[],{"title":64,"metaDescription":65,"keywords":66,"canonicalUrl":67,"structuredData":68},"What is CVE-2025-54864? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2025-54864, a high severity cyber security vulnerability from 2025. Hydra is a continuous integration service for Nix based pro...","CVE-2025-54864, CVE-2025-54864 vulnerability, CVE-2025-54864 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2025, CVSS score, exploit, patch, remediation, nixos security, hydra vulnerability","\u002Fwhat-is\u002Fcve-2025-54864",{"@context":69,"@type":70,"headline":64,"description":65,"datePublished":10,"dateModified":11,"author":71,"publisher":75,"about":79,"mainEntityOfPage":83,"articleSection":86,"keywords":87},"https:\u002F\u002Fschema.org","TechArticle",{"@type":72,"name":73,"url":74},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":72,"name":73,"url":74,"logo":76},{"@type":77,"url":78},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":80,"name":6,"description":81,"additionalType":82},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":84,"@id":85},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2025-54864","Cybersecurity","CVE-2025-54864, CVE-2025-54864 vulnerability, CVE-2025-54864 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[89],{"Operator":26,"Negate":26,"Nodes":90},[91],{"Operator":92,"Negate":61,"CPEMatch":93},"OR",[94],{"Vulnerable":4,"Criteria":39,"MatchCriteriaID":95,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":96,"VersionEndIncluding":26},"778C10E5-6174-40F1-B9E5-E1EBFAA3148E","2025-08-12",[],[99],{"id":100,"eventType":101,"eventTime":102,"details":103,"label":104,"color":105},"e7e3265d-c319-4e2b-9212-b5551bc05c65","NEW_NVD","2025-08-13T04:01:10.058991+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":107,"version":108},1792269983028,"2.0",{"score":110,"band":111,"action":112,"scoredAt":113},47,"Medium","Plan remediation","2026-10-16T07:08:22.502721+00:00"]