VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/ory/hydra: vulnerability history, versions and safety

github.com/ory/hydra is a package in the Go ecosystem. Vulert records 6 vulnerabilities for it across 120 releases, from May 2021 to Mar 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
6 vulnerabilities recorded H1 M2 U3
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
3 in the last 12 months

Most recent disclosure 26 Mar 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/ory/hydra vulnerabilities

Vulert verdict on github.com/ory/hydra v1.11.10 i

Updated on 23 Oct 2026

Careful: 2 of the 6 vulnerabilities Vulert records for this package have no fix yet. Plan around those, or apply the workaround listed for each. The rest have a fixed version to move to.

Package health score 71/100
  • Security Some issues to review
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Plan around the 2 vulnerabilities with no published fix: each lists the affected range and any workaround that reduces exposure. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.11.10 — unaffected i
  • Vulnerabilities on record 6 over 4 years · 3 in the last year i
  • Latest disclosure 26 Mar 2026 i
  • Highest CVSS 7.2 i
  • With no published fix 2 i
  • Stars 17,614 i
  • OpenSSF scorecard 5/10 i
  • Last release 45 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/ory/hydra, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.11.11-0.20221227111756-7599c82db261 27 Dec 2022 H1 M2 U3 Apache-2.0 No Details →
v0.0.0-20221208122313-bfb7d62a66fa 08 Dec 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221208122313-bfb7d62a66fa 08 Dec 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221208112842-16831c55c41e 08 Dec 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221208111123-e8d8de9072fd 08 Dec 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221110171228-c65342e2cc01 10 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221110161557-643e88c3673d 10 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221110161557-c417be1e181f 10 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221103154119-8d92030a364b 03 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221103151839-6184b6a0ad02 03 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221103141107-0eeea9002cb4 03 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221103135151-fd020496a6de 03 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102201938-f8a7ced6c8cc 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102113652-736aaefb6dc4 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102112227-80a1335b1481 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102105310-4fd6baafe72a 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102103039-16bd568fa2ae 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221102011956-70e6fe9c1fed 02 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221101202918-cdfcf4518f7d 01 Nov 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221028104817-d37b3234736a 28 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221028102220-c752125315e1 28 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221028101548-bedaf48674aa 28 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221028095621-dcfd11f02646 28 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221027115539-164f4b5f16f8 27 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221027110357-403223cc50bc 27 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221027065911-8297cfc58e68 27 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221027055934-4d83a289ac59 27 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026201854-0cafe8fb392a 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026143719-1c9f3e0c00bd 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026122407-181dda577093 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026120420-aea37d6a358f 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026114308-c9a8d7de779c 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026092753-55948d863023 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221026091224-4bf995d26104 26 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221025091634-8b77f5ada222 25 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221025084653-ca724399bd25 25 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221025084026-770f05cf61d8 25 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221019113000-8177cb5e2306 19 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221013085409-71226bc9e077 13 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221011150311-f9e71cfecf21 11 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221010113402-1aa6cc43f2a2 10 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221006182943-8b8e73d518df 06 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221006151938-841a1535969e 06 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221006114209-87105903a7e0 06 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221006085333-f979adb447de 06 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221005102605-73437ace4272 05 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221004110657-1d13be6d3b2f 04 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221004093119-5842946d156e 04 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20221004064334-3ba28f2b259f 04 Oct 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220930144150-a73e48db0f6e 30 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220927212408-0b643a3615c4 27 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220926194634-a9c8da01b40d 26 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220923195001-f148145a659e 23 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220923124151-a73301c12e10 23 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220922195739-8b12c9147893 22 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220922123730-be24b804cf00 22 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220915140124-954693feffbb 15 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220914185126-216352e33598 14 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220912131616-c68e1303cc72 12 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220909123623-1cab940846c0 09 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220909121634-49d484772b67 09 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220908170458-09b9318f8876 08 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220908141906-c16ffb46d944 08 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220908135443-cd2c252b4bb7 08 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220908094202-200dc9a41219 08 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220908091712-05bda6bfcc8f 08 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907081222-3895d8a499c0 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907074829-e27e290198c0 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-00490cbbc511 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-019f6bf3c668 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-01dbc0eb54f9 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-02c6d5d4ea7e 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-03b234083772 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-04b308f35a38 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-05eaf6d3be68 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-062734e16aef 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-063f61beb2e9 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-0752721dd87f 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-08968aa9b05b 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-08bbbab1a9be 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-098a98318044 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-0a5ebe8fa1ea 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-0a786b7cd35f 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-10c146b49cb0 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1100aba1e1c5 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1108409abd1c 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-11587aed8484 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1332fe6c4dd8 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-13691d3995f4 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-142cd1338220 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-148cadb2009a 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-17c226cc2ad5 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1a4abd6da988 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1ab345b9ee3e 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1bd0c52302ce 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1c0f971e8be5 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1cb56dfe4d33 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1cf5bd0fc9bb 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1d78e79623af 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1d8a8fff8c41 07 Sep 2022 H1 M2 U3 Apache-2.0 No Details →
v1.11.11-0.20220907061031-1d9891dcf14c 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-1f7bf40e4f76 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-1fd6ea3df645 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-20f2bcda0078 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-210116e32af6 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-21c579ad40d2 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-223c8bc2b1ec 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-22d4a92416eb 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-23585b579776 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-255b4e225bfa 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2592451bbb9e 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2597f190e83b 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2769c9b369d1 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2875c190c424 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2a20080d1d1c 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2adb928cec17 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2b6350c0e6be 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2c4615cea945 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2d5c8930de69 07 Sep 2022 H1 M2 U3 — No Details →
v1.11.11-0.20220907061031-2ee922938b43 07 Sep 2022 H1 M2 U3 — No Details →

The newest 120 of 3,599 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 1
  • 2024 1
  • 2026 3

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 3 of the 6 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/ory/hydra

The 5 most severe of 6 vulnerabilities recorded for this package

Search all 6 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2026-33504: Ory Hydra SQL Injection via Forged Pagination Tokens 7.2 high 2.3.1-0.20260320110106-0b84568fffcc 20 Mar 2026
CVE-2019-8400: ORY Hydra Reflected XSS via error_hint Parameter 6.1 medium 1.4.8 14 May 2022
CVE-2020-5300: Authentication Bypass in hydra 5.8 medium 1.4.0 27 May 2021
CVE-2020-5300: Authentication Bypass in github.com/ory/hydra N/A unrated 1.4.0 21 Aug 2024
CVE-2026-33504: SQL Injection Vulnerability in Ory Hydra via Forged Pagination Tokens N/A unrated No fix published 23 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/ory/hydra

Is github.com/ory/hydra safe to use?

Vulert records 6 vulnerabilities for github.com/ory/hydra in Go: 0 critical, 1 high, 2 medium and 0 low, plus 3 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/ory/hydra's Vulert package health score?

Vulert scores github.com/ory/hydra 71/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Which version of github.com/ory/hydra should I use?

v1.11.10 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/ory/hydra have?

6 vulnerabilities are recorded for github.com/ory/hydra in the Go ecosystem: 0 critical, 1 high, 2 medium and 0 low, plus 3 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/ory/hydra vulnerabilities disclosed?

3 vulnerabilities were recorded for github.com/ory/hydra in the last 12 months, and the oldest entry in this database dates to 27 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/ory/hydra are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/ory/hydra for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/ory/hydra version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.