Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2025-6203

Vault unauthenticated denial of service through complex json payload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Vault

Default version status: unaffected

  • 1.15.0 to < 1.21.0affected

HashiCorp Vault Enterprise

Default version status: unaffected

  • 1.15.0 to < 1.21.2affected

References