Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-12044 · ADVISORY
• hashicorp/vault commit b19e74c · WEB
• hashicorp/vault commit eedc2b7 · WEB
• discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710 · WEB
• hashicorp/vault · PACKAGE
• GitHub Advisory GHSA-vp5w-xcfc-73wf · ADVISORY

Mais vulnerabilidades de github.com/hashicorp/vault

• CVE-2026-5807ALTO 7.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generati…
• CVE-2026-5052ALTO 8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these re…
• CVE-2026-4525ALTO 8.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va…
• CVE-2026-3605ALTO 8.1An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized t…
• CVE-2025-11621ALTO 8.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_princ…