HashiCorp Vault Vulnerability Let Attackers to Crash Servers
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical denial-of-service vulnerability in HashiCorp Vault could allow malicious actors to overwhelm servers with specially crafted JSON payloads, leading to excessive resource consumption and rendering Vault instances unresponsive.\u00a0<\/p>\n
Tracked as CVE-2025-6203 and published on August 28, 2025, the flaw affects both Vault Community and Enterprise editions from version 1.15.0 up to several patched releases.\u00a0<\/p>\n
Operators are urged to upgrade to Vault 1.20.3 (Community and Enterprise), 1.19.9, 1.18.14, or 1.16.25 to mitigate the issue.<\/p>\n
Vault\u2019s audit devices are responsible for logging every request interaction before completing the request.\u00a0<\/p>\n
A malicious user can submit a payload that meets the default max_request_size limit (32 MiB by default) but leverages deeply nested JSON structures or excessive entries to force extreme CPU and memory usage in the audit subroutine.\u00a0<\/p>\n
As the JSON parser recurses through long string values or high object entry counts, memory consumption spikes, triggering timeouts and causing the Vault server to become unresponsive.<\/p>\n
HashiCorp<\/a> has introduced new listener configuration options to further harden Vault against abusive JSON payloads. The TCP listener may now be configured with:<\/p>\n Operators can find detailed guidance<\/a> in the API documentation for listener parameters and the Vault upgrade guide.<\/p>\n HashiCorp acknowledges Darrell Bethea, Ph.D., of Indeed for responsibly reporting this vulnerability.<\/p>\n\n