Advisoriesby IbisBoundaryGHSA-7x9r-wcgg-w86f
Boundary: denial of service
Fix: upgrade to 0.19.5 or later (3 fixed versions below)
Boundary Community Edition and Boundary Enterprise ("Boundary") workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate during the TLS handshake, causing worker connection handling to block. This may prevent legitimate worker connections from being accepted or routed. This vulnerability, CVE-2026-7776, is fixed in Boundary 0.21.3, 0.20.3, 0.19.5.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/boundary Go | < 0.19.5 | 0.19.5 |
| >= 0.20.0, < 0.20.3 | 0.20.3 | |
| >= 0.21.0, < 0.21.3 | 0.21.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- CVE-2026-7776, GO-2026-5237
More Boundary advisories
All Boundary
Boundary Community Edition and Boundary EnterpriseCVE-2024-12289fixed in 0.18.2Boundary vulnerable to session hijacking through TLS certificate tamperingCVE-2024-1052fixed in 0.15.0HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service ConfiguredCVE-2023-0690fixed in 0.12.0Hashicorp Boundary vulnerable to clickjackingCVE-2022-36182no fix yet