Vulnerability · Published Aug 28, 2025 · Assigned by HashiCorp
CVE-2025-6203Vault unauthenticated denial of service through complex json payload
High 7.5
In plain English
A high-severity resource allocation without limits in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.20.3 | GHSA-8f82-53h8-2p34 |
| Go | github.com/hashicorp/vault | 1.20.3 | GO-2025-3924 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 1.15.0 – before 1.21.0 |
| HashiCorp | Vault Enterprise | 1.15.0 – before 1.21.2 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H