CVE-2022-31006: indy-node Denial of Service Vulnerability
Summary
CVE-2022-31006: indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. Affects indy-node across 2 version ranges.
< 1.13.0.dev2
< 53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3
Fixed in 53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. It provides a platform for managing and verifying digital identities in a decentralized manner. indy-node allows multiple client connections to interact with the ledger. However, in vulnerable versions, an attacker can exploit this functionality to overwhelm the ledger with a high number of client connections, rendering it unable to be used for its intended purpose. This vulnerability affects the availability of the ledger but does not impact its content. The ledger will resume functioning after the attack.
Vulnerability Detail
The vulnerability in indy-node arises from the trade-off between resilience and availability. To prevent abusive client connections, network operators can implement firewall rules that limit the number of connections allowed. However, this also restricts access for legitimate users. An attacker can exploit this trade-off by maxing out the number of client connections, effectively causing a denial of service (DoS) attack. The impact of this vulnerability is a temporary unavailability of the ledger for legitimate users.
How To Fix
Latest published version: 1.13.2 as of 23 Oct 2026
pip install --upgrade "indy-node==1.13.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3
This is the first release that contains the fix.
pip install --upgrade "indy-node==53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, network operators can consider implementing rate limiting or other traffic management techniques to mitigate the impact of abusive client connections.
Conclusion
The indy-node Denial of Service vulnerability allows an attacker to overload the ledger with client connections, causing temporary unavailability for legitimate users. Network operators should apply the recommended mitigations by tuning their firewall rules to strike the right balance between protection and accessibility. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for indy-node →
FAQ
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity.
The vulnerability allows an attacker to max out the number of client connections, leading to a temporary denial of service (DoS) attack. The ledger becomes unavailable for legitimate users during the attack.
Network operators should tune their firewall rules to strike the right balance between protecting against DoS attacks and allowing access for legitimate users. The guidance for firewall rules in Indy network deployments has been updated to provide better protection.
No, the vulnerability only affects the availability of the ledger. The ledger content remains intact and the ledger resumes functioning after the attack.
Yes, all versions of indy-node are vulnerable to this denial of service (DoS) attack. The vulnerability has been addressed in version 1.13.0.dev2 and later.
References
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
