PT-2025-42622 · Openbao+1 · Openbao+1

Published 2025-10-17 · Updated 2026-02-09 · CVE-2025-59043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.4.1

Description OpenBao is an open source identity-based secrets management system. Versions prior to 2.4.1 are susceptible to a denial of service condition. Specifically, crafted JSON payloads can cause excessive memory usage during decoding, potentially exceeding the max request size configuration parameter. This can lead to an out-of-memory crash, even for unauthenticated attackers. Additionally, requests containing a large number of strings can cause high CPU consumption within the audit subsystem. The issue stems from a significant difference between the memory used by serialized and deserialized JSON objects, with exploitation factors reaching approximately 35.

Recommendations Update to OpenBao version 2.4.1 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-59043

GHSA-G46H-2RQ9-GW5M

GO-2025-4039

OPENSUSE-SU-2025:15710-1

Affected Products

Openbao

Red Os

References · 98

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59043.json · Exploit
• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m · Vendor Advisory
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c · Patch
• https://osv.dev/vulnerability/GO-2025-4039 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g46h-2rq9-gw5m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6203 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://github.com/openbao/openbao/pull/1756 · Note
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 · Note
• https://suse.com/security/cve/CVE-2025-58356 · Note
• https://suse.com/security/cve/CVE-2025-10954 · Note
• https://suse.com/security/cve/CVE-2016-11074 · Note