Vulnerability · Published Oct 17, 2025 · Assigned by GitHub_M

CVE-2025-59043OpenBao vulnerable to denial of service via malicious JSON request processing

High 7.5

In plain English

A high-severity uncontrolled resource consumption in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 47.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.22	openbao	2.4.1-r0	ALPINE-CVE-2025-59043
Alpine:v3.23	openbao	2.4.1-r0	ALPINE-CVE-2025-59043
Alpine:v3.24	openbao	2.4.1-r0	ALPINE-CVE-2025-59043
Go	github.com/openbao/openbao	2.4.1	GHSA-g46h-2rq9-gw5m
Go	github.com/openbao/openbao	no fix listed	GO-2025-4039

Affected products (as reported)

Vendor	Product	Versions
openbao	openbao	< 2.4.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m x_refsource_CONFIRM
https://github.com/openbao/openbao/pull/1756 x_refsource_MISC
https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c x_refsource_MISC
https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 x_refsource_MISC