VaultGHSA-6p62-6cg9-f5f5
Memory exhaustion in HashiCorp Vault
High7.5CVE-2023-6337 · Published Dec 9, 2023 · updated Feb 13, 2025
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.15.0, < 1.15.4 | 1.15.4 |
| >= 1.14.0, < 1.14.8 | 1.14.8 | |
| >= 1.12.0, < 1.13.12 | 1.13.12 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- BIT-vault-2023-6337, CVE-2023-6337, GO-2023-2399
More Vault advisories
All Vault| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 312024 | Improper Authentication in HashiCorp Vault High7.5Jan 31, 2024 | High7.5 | 1.6.2 |
| Jan 312024 | Enumeration of users in HashiCorp VaultMedium6.5Jan 31, 2024 | Medium6.5 | 1.5.6+1 more |
| Jan 312024 | HashiCorp Vault Authentication bypassHigh8.2Jan 31, 2024 | High8.2 | 1.2.5+3 more |
| Jan 302024 | HashiCorp Vault Improper Privilege ManagementMedium5.3Jan 30, 2024 | Medium5.3 | 1.3.4 |
| Jan 302024 | HashiCorp Vault Improper Privilege ManagementCritical9.1Jan 30, 2024 | Critical9.1 | 1.3.4 |
| Nov 92023 | HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerabilityHigh7.5Nov 9, 2023 | High7.5 | 1.13.10+2 more |