Skip to content
vaultGHSA-2qmw-pvf7-4mw6

Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions

High7.5CVE-2024-6468 · Published Jul 11, 2024 · updated Sep 10, 2026

GitHub advisory

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.10.0, < 1.15.121.15.12
>= 1.16.0-rc1, < 1.16.31.16.3
>= 1.17.0-rc1, < 1.17.21.17.2
Details and references

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-703
Also known as
BIT-vault-2024-6468, CVE-2024-6468, GO-2024-2982

More vault advisories

All
DateAdvisory
Jun 122024HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
CVE-2024-5798Low2.6fixed in 1.15.9, 1.16.3, 1.17.0
Sep 22024Vault Leaks Client Token and Token Accessor in Audit Devices
CVE-2024-8365Medium6.5fixed in 1.17.5
Oct 102024Vault Community Edition privilege escalation vulnerability
CVE-2024-9180High7.2fixed in 1.18.0
Apr 42024HashiCorpVault does not correctly validate OCSP responses
CVE-2024-2660Medium6.4fixed in 1.16.0
Oct 312024Hashicorp Vault vulnerable to denial of service through memory exhaustion
CVE-2024-8185High7.5fixed in 1.18.1
Mar 42024Incorrect TLS certificate auth method in Vault
CVE-2024-2048High8.1fixed in 1.14.10, 1.15.5

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.