← Back

CVE-2025-4656

nvd nist
Published: Jun 25, 2025Modified: Jun 17, 2026

JSON object

Loading...
3.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Exploitability: 1.6 / Impact: 1.4
Source: security@hashicorp.com (Secondary)

Description

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Affected (5)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
From 1.14.8 to 1.20.0
Vault
From 1.14.8 to 1.16.22
Vault
From 1.17.0 to 1.17.17
Vault
From 1.18.0 to 1.18.11
Vault
From 1.19.0 to 1.19.6

Related CWEs

CWE-1088
Synchronous Access of Remote Resource without Timeout
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.