PT-2025-35133 · Hashicorp+1 · Vault Community Edition+2

Darrell Bethea · Published 2025-08-28 · Updated 2025-12-18 · CVE-2025-6203

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.20.3 HashiCorp Vault Enterprise versions 1.19.9, 1.18.14, and 1.16.25

Description A malicious user can submit a specially crafted payload that results in excessive memory and CPU consumption, potentially leading to a timeout in Vault’s auditing subroutine and causing the server to become unresponsive. Approximately 123,600 services are potentially exposed worldwide. Over 29,800 vulnerable instances have been identified.

Recommendations HashiCorp Vault versions prior to 1.20.3 should be upgraded to version 1.20.3 or later. HashiCorp Vault Enterprise versions prior to 1.19.9 should be upgraded to version 1.19.9 or later. HashiCorp Vault Enterprise versions prior to 1.18.14 should be upgraded to version 1.18.14 or later. HashiCorp Vault Enterprise versions prior to 1.16.25 should be upgraded to version 1.16.25 or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2025-10637

BIT-VAULT-2025-6203

CVE-2025-6203

GHSA-8F82-53H8-2P34

GHSA-G46H-2RQ9-GW5M

GO-2025-3924

GO-2025-4039

OPENSUSE-SU-2025:15538-1

OPENSUSE-SU-2025:15579-1

SUSE-SU-2025:03289-1

Affected Products

Red Os

Vault Community Edition

Vault Enterprise

References · 75

• https://osv.dev/vulnerability/BIT-vault-2025-6203 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4039 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g46h-2rq9-gw5m · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15579-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59043 · Security Note
• https://osv.dev/vulnerability/GO-2025-3924 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10637 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6203 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6203 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f82-53h8-2p34 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15538-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab89 · Note