Advisoriesby IbisVaultGHSA-6p62-6cg9-f5f5
Memory exhaustion in HashiCorp Vault
Fix: upgrade to 1.13.12 or later (3 fixed versions below)
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.
Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.15.0, < 1.15.4 | 1.15.4 |
| >= 1.14.0, < 1.14.8 | 1.14.8 | |
| >= 1.12.0, < 1.13.12 | 1.13.12 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- BIT-vault-2023-6337, CVE-2023-6337, GO-2023-2399
More Vault advisories
All Vault
Improper Authentication in HashiCorp VaultCVE-2021-3282fixed in 1.6.2Enumeration of users in HashiCorp VaultCVE-2020-35177fixed in 1.5.6 +1HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3HashiCorp Vault Improper Privilege ManagementCVE-2020-10660fixed in 1.3.4HashiCorp Vault Improper Privilege ManagementCVE-2020-10661fixed in 1.3.4HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityCVE-2023-5954fixed in 1.13.10 +2