CVE-2025-6203: DoS Flaw in HashiCorp Vault Allows Attackers to Crash Servers

HashiCorp has issued a security advisory for CVE-2025-6203, a Denial-of-Service weakness in Vault that could allow a malicious user to crash servers by submitting specially crafted JSON payloads, with the flaw rated CVSS 7.5 (High).

The issue stems from Vault’s handling of complex JSON requests, where a malicious payload that meets the default size limit can cause excessive memory and CPU usage, potentially leading to a timeout in Vault’s auditing subroutine and making the Vault server unresponsive, according to the advisory.

The vulnerability affects Vault Community and Enterprise editions, spanning versions 1.15.0 up to 1.20.2, including 1.19.8, 1.18.13, and 1.16.24, and a patched set is available: Vault 1.20.3 (Community & Enterprise) and Vault Enterprise 1.19.9, 1.18.14, and 1.16.25. HashiCorp has added new listener configuration options to tighten JSON payload limits, including max_json_depth, max_json_string_value_length, max_json_object_entry_count, and max_json_array_element_count, to give operators more granular defenses. The advisory also notes that upgrading to the specified patched versions is strongly recommended.