logo

Database

Asymmetric denial of service In github.com/hashicorp/vault

Description

Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON Vault and Vault Enterprise ("Vault") are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2025-120442. NVD-2025-120443. OSV-2025-120444. GCVE-2025-12044

References

1. https://github.com/hashicorp/vault/commit/b19e74c29a33ed2a99fc01626104db1a49345df32. https://github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab893. https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.