GHSA-vp5w-xcfc-73wf

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

Source: GitHub Advisory Database (reviewed) High CVE-2025-12044

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/vault	>= 1.20.3, < 1.21.0	1.21.0

Details

As written in the advisory (Markdown source, shown as plain text).

Vault and Vault Enterprise ("Vault") are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-12044 advisory
https://github.com/hashicorp/vault/commit/b19e74c29a33ed2a99fc01626104db1a49345df3 web
https://github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab89 web
https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710 web
https://github.com/hashicorp/vault package