CVE-2026-112072

The vault-java-driver (a Java client for HashiCorp Vault) is vulnerable to a StackOverflowError due to an uncontrolled recursion issue in its vendored minimal-json parser . The parser lacks a nesting depth limit, allowing deeply nested JSON values to crash the reading thread. This impact is persi...

CVE-2026-109408

The io.github.jopenlibs:vault-java-driver (versions 5.2.0 through 6.2.3) is vulnerable to a flaw where it silently disables TLS certificate and hostname verification. The root cause occurs in three specific scenarios: when an SslConfig is passed to VaultConfig without calling build(), when an Ssl...