CVE-2025-54864: NixOS Hydra DOS Vulnerability

CVE-2025-54864 Overview

CVE-2025-54864 affects Hydra, a continuous integration service for Nix-based projects. The vulnerability resides in two API endpoints, /api/push-github and /api/push-gitea, which accept evaluation triggers from upstream forges without HTTP Basic authentication. While both forges support HMAC signing with a secret key, prior to commit f7bda02 Hydra did not validate these signatures. Unauthenticated network attackers can repeatedly invoke these endpoints to trigger large evaluations, exhausting host resources. The flaw is tracked as a missing authentication weakness [CWE-306] and was patched upstream in the NixOS Hydra repository.

Critical Impact
Unauthenticated attackers can trigger resource-intensive evaluations on Hydra instances, leading to denial of service against the host running the evaluator.

Affected Products

NixOS Hydra (all versions prior to commit f7bda02)
Hydra deployments exposing /api/push-github to untrusted networks
Hydra deployments exposing /api/push-gitea to untrusted networks

Discovery Timeline

2025-08-12 - CVE-2025-54864 published to NVD
2025-09-22 - Last updated in NVD database

Technical Details for CVE-2025-54864

Vulnerability Analysis

Hydra exposes two webhook endpoints that integrate with GitHub and Gitea forges. The endpoints /api/push-github and /api/push-gitea are designed to receive push notifications and trigger Nix evaluations. Prior to the patch, neither endpoint required HTTP Basic authentication, nor did the handlers verify the HMAC signatures that GitHub and Gitea attach to webhook deliveries.

An attacker who can reach these endpoints over the network can issue repeated requests, each instructing Hydra to perform an evaluation. Large evaluations consume substantial CPU, memory, and I/O on the host running the evaluator. Sustained requests can render the Hydra instance unresponsive and disrupt continuous integration workflows.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. Hydra trusted that requests arriving at /api/push-github and /api/push-gitea originated from the corresponding forge, but never validated the HMAC signature header that the forges provide. Any network client could impersonate a legitimate webhook delivery.

Attack Vector

The attack is conducted over the network without prior authentication or user interaction. An attacker sends crafted HTTP POST requests to the vulnerable endpoints, targeting projects configured for large evaluations. No code execution or data disclosure occurs; the impact is limited to availability of the Hydra evaluator host.

text

// Patch excerpt: src/lib/Hydra/Controller/API.pm
 use Digest::SHA qw(sha256_hex);
 use Text::Diff;
 use IPC::Run qw(run);
+use Digest::SHA qw(hmac_sha256_hex);
+use String::Compare::ConstantTime qw(equals);

 sub api : Chained('/') PathPart('api') CaptureArgs(0) {

Source: NixOS Hydra commit f7bda02

The patch introduces hmac_sha256_hex for computing webhook signatures and String::Compare::ConstantTime::equals for constant-time comparison, preventing timing-based bypasses against the signature check.

text

// Patch excerpt: t/Hydra/Controller/API/checks.t
 use HTTP::Request;
 use HTTP::Request::Common;
 use JSON::MaybeXS qw(decode_json encode_json);
+use Digest::SHA qw(hmac_sha256_hex);

 sub is_json {
     my ($response, $message) = @_;

Source: NixOS Hydra commit f7bda02

The accompanying test additions exercise the new HMAC verification path to confirm that requests lacking a valid signature are rejected.

Detection Methods for CVE-2025-54864

Indicators of Compromise

Repeated POST requests to /api/push-github or /api/push-gitea from unexpected source IPs in Hydra web server access logs.
Sustained high CPU, memory, or I/O usage on the Hydra evaluator host with no corresponding legitimate forge activity.
Evaluation queue growth that does not correlate with developer push events recorded in GitHub or Gitea.
Requests to the webhook endpoints missing or carrying invalid X-Hub-Signature-256 or equivalent HMAC headers.

Detection Strategies

Correlate Hydra webhook endpoint hits against the known IP ranges published by GitHub and your Gitea instance, alerting on mismatches.
Baseline the rate of evaluation triggers per project and alert when the rate exceeds historical norms.
Parse reverse proxy logs to detect bursts of POST requests to the two endpoints from a single source.

Monitoring Recommendations

Forward Hydra and reverse proxy access logs to a central log platform for long-term retention and analysis.
Monitor evaluator host resource metrics with alert thresholds tuned for sustained saturation.
Track Hydra queue depth and evaluation duration as service health indicators.

How to Mitigate CVE-2025-54864

Immediate Actions Required

Update Hydra to a build that includes commit f7bda02 or later.
Configure the HMAC secret in Hydra and on each connected GitHub or Gitea webhook so signatures are validated end to end.
Restrict network exposure of /api/push-github and /api/push-gitea to the IP ranges of the upstream forges.
Review reverse proxy and Hydra access logs for prior abuse of the unauthenticated endpoints.

Patch Information

The vulnerability is fixed by commit f7bda020c6144913f134ec616783e57817f7686f in the NixOS Hydra repository. The fix adds HMAC SHA-256 verification with constant-time comparison on both webhook endpoints. Refer to the NixOS Hydra GitHub Security Advisory GHSA-qpq3-646c-vgx9 and the patch commit for full details.

Workarounds

Block /api/push-github and /api/push-gitea at the reverse proxy until the patch is applied.
Apply an IP allowlist at the reverse proxy that only permits the GitHub and Gitea webhook source ranges.
Rate-limit requests to the webhook endpoints to cap the impact of automated triggering.

bash

# Example NGINX reverse proxy block for unpatched Hydra instances
location ~ ^/api/push-(github|gitea)$ {
    # Allow only trusted forge networks
    allow 140.82.112.0/20;   # GitHub webhook range example
    allow 10.0.0.0/24;       # Internal Gitea instance
    deny all;

    limit_req zone=hydra_webhook burst=5 nodelay;
    proxy_pass http://hydra_backend;
}