Vulnerability · Published Dec 8, 2023 · Assigned by HashiCorp
CVE-2023-6337Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
High 7.5
In plain English
A high-severity resource allocation without limits in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.15.4 | GHSA-6p62-6cg9-f5f5 |
| Go | github.com/hashicorp/vault | 1.14.8 | GHSA-6p62-6cg9-f5f5 |
| Go | github.com/hashicorp/vault | 1.13.12 | GHSA-6p62-6cg9-f5f5 |
| Go | github.com/hashicorp/vault | 1.13.12, 1.14.8, 1.15.4 | GO-2023-2399 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 1.12.0 – before 1.15.4 |
| HashiCorp | Vault Enterprise | 1.12.0 – before 1.15.4 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H