← Back

CVE-2025-6203

nvd nist
Published: Aug 28, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security@hashicorp.com (Secondary)

Description

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.

Affected (5)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
From 1.15.0 to 1.21.0
Vault
From 1.15.0 to 1.16.27
Vault
From 1.18.0 to 1.18.15
Vault
From 1.19.0 to 1.19.11
Vault
From 1.20.0 to 1.20.5

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.