HashiCorp Vault Vulnerability Allows Attackers to Crash Servers

A critical vulnerability in HashiCorp Vault, tracked as CVE-2025-6203 (HCSEC-2025-24), has been disclosed that allows malicious actors to submit specially crafted payloads capable of exhausting server resources and rendering Vault instances unresponsive, according to HashiCorp. The flaw affects Vault Community and Vault Enterprise editions from versions 1.15.0 through 1.20.2, with some earlier patch versions also affected, and was publicly disclosed on 28 August 2025.

An upgrade to fixed releases, including Vault 1.20.3 and corresponding Enterprise patches, eliminates the risk, according to the reporting. The attack leverages the auditing subsystem, where a complex request payload that fits the default 32 MiB limit can still trigger deep JSON structures, causing excessive memory and CPU usage and potentially stalling the main thread to crash or hang the server.

HashiCorp has introduced new listener configuration parameters to constrain JSON payloads, such as max_json_depth, max_json_string_value_length, max_json_object_entry_count, and max_json_array_element_count, alongside the existing max_request_size setting. Administrators are urged to upgrade and review Vault’s listener configurations to mitigate similar risks in future.