BoundaryGHSA-xx83-cxmq-x89m
Boundary Community Edition and Boundary Enterprise
Medium5.9CVE-2024-12289 · Published Dec 13, 2024 · updated Feb 3, 2026
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/boundary Go | < 0.18.2 | 0.18.2 |
Details and references
More Boundary advisories
All Boundary| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 5 | Boundary: denial of service High7.5May 5 | High7.5 | 0.19.5+2 more |
| Feb 52024 | Boundary vulnerable to session hijacking through TLS certificate tamperingHigh8.0Feb 5, 2024 | High8.0 | 0.15.0 |
| Jul 62023 | HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service ConfiguredHigh7.1Jul 6, 2023 | High7.1 | 0.12.0 |
| Oct 272022 | Hashicorp Boundary vulnerable to clickjackingMedium6.1Oct 27, 2022 | Medium6.1 | No fix yet |