HashiCorp Patches Vault Flaws: AWS Auth Bypass and Unauthenticated JSON DoS

Two high-severity vulnerabilities disclosed by HashiCorp could expose Vault deployments to denial-of-service attacks and cross-account authentication bypasses, with urgent patching advised. HashiCorp confirmed Vault and Vault Enterprise are vulnerable to an unauthenticated denial of service when processing JSON payloads due to a regression introduced after an earlier fix for HCSEC-2025-24, tracked as CVE-2025-12044 (CVSS 7.5).

According to HashiCorp’s advisory, rate limits were applied after JSON payload processing rather than before, enabling resource exhaustion through large but valid JSON requests. The second vulnerability, CVE-2025-11621 (CVSS 8.1), affects Vault’s AWS Auth method and could allow an authentication bypass in multi-account environments, arising when the same IAM role name exists across accounts or a wildcard is used in bound_principal_iam.

HashiCorp notes that the cache did not validate the account ID when querying, meaning a separate account could impersonate a matching role name. Patches are available in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0, and administrators are advised to upgrade immediately.