Hasura GraphQL Engine v2.45.6 updates OpenSSL to address CVE‑2026‑45447

by

Overview

On July 10, 2026, Hasura published release v2.45.6 of the GraphQL Engine. The update is a targeted patch that upgrades the OpenSSL library used in the official Ubuntu‑based Docker image.

What changed

  • OpenSSL version in the Ubuntu base image was upgraded to a build that contains the fix for CVE‑2026‑45447.
  • No functional changes to the GraphQL Engine itself; the release is purely a security‑focused packaging update.

About CVE‑2026‑45447

The vulnerability, tracked as CVE‑2026‑45447, is a heap use‑after‑free bug in the PKCS7_verify() function of OpenSSL. Successful exploitation can lead to arbitrary code execution or denial of service.

Impact for Hasura users

Any deployment that runs the official Hasura Docker image based on Ubuntu inherits the vulnerable OpenSSL version. Until the patch is applied, those instances are exposed to the same risk as any other OpenSSL‑affected service.

Upgrade path

To apply the fix, pull the updated image tag:

docker pull hasura/graphql-engine:v2.45.6

Then redeploy your containers using the new image. No schema migrations or configuration changes are required.

Conclusion

Hasura’s quick response demonstrates a responsible approach to third‑party library vulnerabilities. Users should upgrade to v2.45.6 promptly to mitigate the CVE‑2026‑45447 risk.