CVE-2025-54864

CVE-2025-54864 is a denial-of-service vulnerability affecting Hydra, a continuous integration service for Nix-based projects. Specifically, the /api/push-github and /api/push-gitea endpoints lacked HTTP Basic authentication, allowing unauthenticated attackers to trigger resource-intensive evaluations. This vulnerability carries a CVSS score of 7.5 (High), indicating it can be exploited remotely with low complexity to achieve a high impact on availability. While HMAC signing is present, the absence of basic authentication allows for potential denial-of-service attacks. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.