{"id":"EUVD-2025-35718","revision":"73529ed8e40b4234a5f2bbb0b2b5995e","records":[{"revision":"73529ed8e40b4234a5f2bbb0b2b5995e","observedAt":"2026-10-29T21:51:27.696+00:00","statement":{"source":"euvd","id":"EUVD-2025-35718","aliases":["CVE-2025-12044","GHSA-vp5w-xcfc-73wf"],"title":"Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-2…","description":"Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]\u00A0 which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35718","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 23, 2025, 7:15:16 PM","dateUpdated":"Oct 23, 2025, 8:00:16 PM"},"relatedAdvisories":[{"id":"openSUSE-SU-2025:15710-1","title":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","vulnerabilityIds":["CVE-2016-11063","CVE-2016-11066","CVE-2016-11067","CVE-2016-11068","CVE-2016-11069","CVE-2016-11070","CVE-2016-11071","CVE-2016-11072","CVE-2016-11073","CVE-2016-11074","CVE-2016-11075","CVE-2016-11076","CVE-2016-11077","CVE-2016-11078","CVE-2016-11079","CVE-2016-11080","CVE-2016-11081","CVE-2016-11082","CVE-2016-11083","CVE-2016-11084","CVE-2017-18872","CVE-2023-32199","CVE-2024-58269","CVE-2025-10545","CVE-2025-10678","CVE-2025-10954","CVE-2025-11374","CVE-2025-11375","CVE-2025-11579","CVE-2025-11621","CVE-2025-12044","CVE-2025-26625","CVE-2025-27093","CVE-2025-41410","CVE-2025-41443","CVE-2025-54286","CVE-2025-54287","CVE-2025-54288","CVE-2025-54289","CVE-2025-54290","CVE-2025-54291","CVE-2025-54293","CVE-2025-54469","CVE-2025-54470","CVE-2025-54471","CVE-2025-54499","CVE-2025-58073","CVE-2025-58075","CVE-2025-58356","CVE-2025-59043","CVE-2025-59048","CVE-2025-59530","CVE-2025-59836","CVE-2025-59937","CVE-2025-61141","CVE-2025-61524","CVE-2025-61581","CVE-2025-61688","CVE-2025-62156","CVE-2025-62157","CVE-2025-62375","CVE-2025-62506","CVE-2025-62513","CVE-2025-62705","CVE-2025-62714","CVE-2025-62725","CVE-2025-62820","CVE-2025-64101","CVE-2025-64102","CVE-2025-64103"]},{"id":"RHSA-2025:21984","title":"Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"WID-SEC-W-2025-2396","title":"Hashicorp Vault: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"RHSA-2025:22058","title":"Red Hat Security Advisory: RHTAS 1.3.1 - Tech Preview Release Of the Policy Controller Operator","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"RHSA-2025:21988","title":"Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"RHSA-2025:21976","title":"Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"RHSA-2025:21981","title":"Red Hat Security Advisory: RHTAS 1.3.1 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044"]},{"id":"RHSA-2026:3827","title":"Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3","vulnerabilityIds":["CVE-2025-11621","CVE-2025-12044","CVE-2025-47913","CVE-2025-61729","CVE-2025-66506","CVE-2025-66564"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-35718","identifiers":["EUVD-2025-35718","CVE-2025-12044","GHSA-vp5w-xcfc-73wf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}