AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

VaultGHSA-fhc2-8qx8-6vj7

Vault Community Edition rekey and recovery key operations can cause denial of service

Vault

CVE-2025-4656 · Published Jun 26, 2025 · updated Sep 10, 2026

Low3.1
Fix: upgrade to 1.20.0 or later
GitHub advisory

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.14.8, < 1.20.01.20.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-1088
Also known as
BIT-vault-2025-4656, CVE-2025-4656, GO-2025-3788

More Vault advisories

All Vault
Medium 5.7Aug 1, 2025Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015fixed in 1.20.1Medium 6.5Aug 1, 2025Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseCVE-2025-6014fixed in 1.20.1Medium 5.3Aug 1, 2025Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004fixed in 1.20.1Low 3.7Aug 1, 2025Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Critical 9.1Aug 1, 2025Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1High 7.2Aug 1, 2025Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0