CVE-2023-5954

Published: Nov 9, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

Affected (6)

Products: Hashicorp: Vault

Hashicorp

1 product

Vault

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	1.13.7 ≤ version < 1.13.10
Hashicorp Vault	1.14.3 ≤ version < 1.14.6
Hashicorp Vault	1.15.0 ≤ version < 1.15.2
Hashicorp Vault	1.13.7 ≤ version < 1.13.10
Hashicorp Vault	1.14.3 ≤ version < 1.14.6
Hashicorp Vault	1.15.0 ≤ version < 1.15.2

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (4)

https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926

Source: security@hashicorp.com

Vendor Advisory

https://security.netapp.com/advisory/ntap-20231227-0001/

Source: security@hashicorp.com

https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.netapp.com/advisory/ntap-20231227-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.