Vault Vulnerable to Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

🗓️ 08 Dec 2023 20:45:16Reported by HashiCorp Security TeamType

Vault is vulnerable to memory exhaustion DoS from large requests; fixed in versions 1.15.4, 1.14.8, and 1.13.12.

Reporter	Title	Published	Views	Family All 22
Tenable Nessus	Azure Linux 3.0 Security Update: cert-manager (CVE-2023-6337)	22 Jan 202600:00	–	nessus
BDU FSTEC	The vulnerability of the `max_request_duration` component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to trigger a service failure.	13 Dec 202300:00	–	bdu_fstec
CBLMariner	CVE-2023-6337 affecting package cert-manager for versions less than 1.12.12-1	25 Aug 202415:13	–	cbl_mariner
Circl	CVE-2023-6337	12 Jan 202415:31	–	circl
CNNVD	HashiCorp Vault Security Breach	8 Dec 202300:00	–	cnnvd
CVE	CVE-2023-6337	8 Dec 202321:12	–	cve
Cvelist	CVE-2023-6337 Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests	8 Dec 202321:12	–	cvelist
EUVD	EUVD-2023-3128	3 Oct 202520:07	–	euvd
Github Security Blog	Memory exhaustion in HashiCorp Vault	9 Dec 202300:35	–	github
Microsoft CVE	Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests	11 Sep 202407:00	–	mscve