hydra-core
PyPI4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting hydra-corepage 1 of 1
- CVE-2026-106439HIGHCVSS 8.5EG 8.5fixed in 1.3.7 or 1.4.0.dev10, by version range2026-10-06
vulnerable: 1.4.0.dev4, 1.4.0.dev5, 1.4.0.dev6, 1.4.0.dev8, 1.4.0.dev9
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.7 and 1.4.0.dev10, Hydra stores legacy instantiate target blocklists and related execution-policy collections in mutable module-level state. An attac…
- CVE-2026-106441HIGHCVSS 7.8EG 7.8fixed in 1.3.6 or 1.4.0.dev9, by version range2026-10-06
vulnerable: 1.4.0.dev1 ... 1.4.0.dev8 (6 versions)
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or …
- CVE-2026-106442HIGHCVSS 7.8EG 7.8fixed in 1.3.6 or 1.4.0.dev9, by version range2026-10-06
vulnerable: 1.4.0.dev1 ... 1.4.0.dev8 (6 versions)
Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target …
- CVE-2026-68508HIGHCVSS 7.8EG 7.8fixed in 1.3.42026-08-21
vulnerable: 0.1.4 ... 1.3.3 (48 versions)
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiat…
Check whether hydra-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hydra-core CVEs against the assets you own.
Book a Demo →