# CVE-2020-11090: Hyperledger Indy Node denial of service in TAA transaction handling

Source: https://junglewise.ai/threats/cve-2020-11090-hyperledger-indy-node-denial-of-service-in-taa-transaction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-06-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2020-11090 · Severity: low · CVSS 3.1 · Published 2020-06-11

Hyperledger Indy Node is a blockchain node implementation used in distributed ledger networks. A malformed transaction containing an invalid TAA (Transaction Author Agreement) can crash the current primary node and trigger a view change, causing consensus failures. Repeated attacks could render the entire network unable to process write transactions, disrupting all network participants.

Technologies: [indy-node (PyPI)](https://junglewise.ai/threats/technologies/indy-node). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-11090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-11090 being exploited in the wild.

**How severe is CVE-2020-11090?** Low severity, with a CVSS score of 3.1, published 11 June 2020.

**Which products and versions are affected?** indy-node (PyPI) ECOSYSTEM:introduced=0,fixed=1.12.3, ECOSYSTEM:introduced=1.12.2,fixed=1.12.3.

**Is there a fix for CVE-2020-11090?** Yes. indy-node (PyPI): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-11090 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-11090?** Check whether you run indy-node (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- indy-node (PyPI): upgrade to 1.12.3 or later

  ```sh
  pip install "indy-node>=1.12.3"
  ```


## Technical details

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the TAA (Transaction Author Agreement) handling code of Indy Node. When a client sends a malformed transaction with an invalid TAA, the primary node fails to validate it correctly and crashes, triggering a consensus view change. An unauthenticated network-reachable attacker can repeatedly send malformed TAA transactions to trigger cascading view changes that degrade or eliminate network consensus. The bug was fixed in version 1.12.3, released shortly after discovery on the Sovrin network in May 2020.

## Affected products

- Hyperledger Indy Node 1.12.2

## Identifiers

- CVE-2020-11090
- GHSA-3gw4-m5w7-v89c
- PYSEC-2020-47

## Timeline

- 2020-06-08: disclosed
- 2020-06-11: patched: Fixed in version 1.12.3
- 2020-05-18: exploited: Discovered in wild on Sovrin StagingNet

## References

- [https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c](https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c)

## Related threats

- [Hyperledger indy-node vulnerable to denial of service](https://junglewise.ai/threats/cve-2022-31006-hyperledger-indy-node-vulnerable-to-denial-of-service)
- [Indy's NODE_UPGRADE transaction vulnerable to remote code execution](https://junglewise.ai/threats/cve-2022-31020-indy-s-node-upgrade-transaction-vulnerable-to-remote-code)
- [Hyperledger Indy's update process of a DID does not check who signs the request](https://junglewise.ai/threats/cve-2020-11093-hyperledger-indy-s-update-process-of-a-did-does-not-check-who)