AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

BoundaryGHSA-xx83-cxmq-x89m

Boundary Community Edition and Boundary Enterprise

Boundary

CVE-2024-12289 · Published Dec 13, 2024 · updated Feb 3, 2026

Medium5.9
Fix: upgrade to 0.18.2 or later
GitHub advisory

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.

This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/boundary
Go
< 0.18.20.18.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-460, CWE-665
Also known as
CVE-2024-12289, GO-2024-3335

More Boundary advisories

All Boundary
High 7.5May 5Boundary: denial of serviceCVE-2026-7776fixed in 0.19.5 +2High 8.0Feb 5, 2024Boundary vulnerable to session hijacking through TLS certificate tamperingCVE-2024-1052fixed in 0.15.0High 7.1Jul 6, 2023HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service ConfiguredCVE-2023-0690fixed in 0.12.0Medium 6.1Oct 27, 2022Hashicorp Boundary vulnerable to clickjackingCVE-2022-36182no fix yet