GitHub Advisory DatabaseGHSA-6P62-6CG9-F5F5Memory exhaustion in HashiCorp Vault
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.0%
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.
Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/hashicorp/vault | lt | 1.13.12 | |
| github.com/hashicorp/vault | lt | 1.14.8 | |
| github.com/hashicorp/vault | lt | 1.15.4 |
References
discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741
github.com/advisories/GHSA-6p62-6cg9-f5f5
github.com/hashicorp/vault/pull/24354
nvd.nist.gov/vuln/detail/CVE-2023-6337
security.netapp.com/advisory/ntap-20240112-0006
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.0%