PT-2025-35133 · Hashicorp+1 · Vault Community Edition+2

Darrell Bethea · Publicado 2025-08-28 · Atualizado 2025-12-18 · CVE-2025-6203

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.20.3 HashiCorp Vault Enterprise versions 1.19.9, 1.18.14, and 1.16.25

Description A malicious user can submit a specially crafted payload that results in excessive memory and CPU consumption, potentially leading to a timeout in Vault’s auditing subroutine and causing the server to become unresponsive. Approximately 123,600 services are potentially exposed worldwide. Over 29,800 vulnerable instances have been identified.

Recommendations HashiCorp Vault versions prior to 1.20.3 should be upgraded to version 1.20.3 or later. HashiCorp Vault Enterprise versions prior to 1.19.9 should be upgraded to version 1.19.9 or later. HashiCorp Vault Enterprise versions prior to 1.18.14 should be upgraded to version 1.18.14 or later. HashiCorp Vault Enterprise versions prior to 1.16.25 should be upgraded to version 1.16.25 or later.

Correção

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

BDU:2025-10637

BIT-VAULT-2025-6203

CVE-2025-6203

GHSA-8F82-53H8-2P34

GHSA-G46H-2RQ9-GW5M

GO-2025-3924

GO-2025-4039

OPENSUSE-SU-2025:15538-1

OPENSUSE-SU-2025:15579-1

SUSE-SU-2025:03289-1

Produtos afetados

Red Os

Vault Community Edition

Vault Enterprise

Referências · 75

• https://github.com/hashicorp/vault · Nota
• https://github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab89 · Nota
• https://github.com/openbao/openbao · Nota
• https://github.com/openbao/openbao/pull/1756 · Nota
• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m · Nota
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 · Nota
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c · Nota
• https://suse.com/security/cve/CVE-2025-47906 · Nota
• https://suse.com/security/cve/CVE-2025-6203 · Nota
• https://suse.com/security/cve/CVE-2025-58430 · Nota
• https://twitter.com/fofabot/status/1962731136058286373 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-58437 · Nota
• https://suse.com/security/cve/CVE-2025-58450 · Nota
• https://suse.com/security/cve/CVE-2025-54376 · Nota
• https://suse.com/security/cve/CVE-2025-9566 · Nota