{"id":"EUVD-2025-26143","revision":"6c3d6ae5bc03485faf4e666f4fc88f87","records":[{"revision":"6c3d6ae5bc03485faf4e666f4fc88f87","observedAt":"2026-11-05T02:54:48.428+00:00","statement":{"source":"euvd","id":"EUVD-2025-26143","aliases":["CVE-2025-6203","GHSA-8f82-53h8-2p34"],"title":"A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, p…","description":"A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26143","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 28, 2025, 7:36:09 PM","dateUpdated":"Oct 23, 2025, 6:18:34 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15579-1","title":"openbao-2.4.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-6203"]},{"id":"openSUSE-SU-2025:15538-1","title":"govulncheck-vulndb-0.0.20250908T141310-1.1 on GA media","vulnerabilityIds":["CVE-2024-52284","CVE-2024-58259","CVE-2025-51667","CVE-2025-53884","CVE-2025-54467","CVE-2025-55190","CVE-2025-56760","CVE-2025-56761","CVE-2025-58355","CVE-2025-6203","CVE-2025-8077","CVE-2025-9566"]},{"id":"WID-SEC-W-2025-1925","title":"Hashicorp Vault: Schwachstelle ermöglicht Denial of Service","vulnerabilityIds":["CVE-2025-6203"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-26143","identifiers":["EUVD-2025-26143","CVE-2025-6203","GHSA-8f82-53h8-2p34"]},"retained":false,"historicalAffected":[]}],"coverage":[]}