{"id":"GHSA-vp5w-xcfc-73wf","revision":"0b4cfbef080a4ef5b9789ac0ad48890b","records":[{"revision":"0b4cfbef080a4ef5b9789ac0ad48890b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vp5w-xcfc-73wf","aliases":["BIT-vault-2025-12044","CVE-2025-12044","GO-2025-4071"],"title":"Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON","description":"Vault and Vault Enterprise (\"Vault\") are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]\u00A0 which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.","state":0,"publishedAt":"2025-10-23T21:31:44+00:00","modifiedAt":"2026-09-10T03:50:58.3847585+00:00","affected":[{"ecosystem":"Go","name":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.20.3"},{"kind":"fixed","version":"1.21.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-12044","https://github.com/hashicorp/vault/commit/b19e74c29a33ed2a99fc01626104db1a49345df3","https://github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab89","https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710","https://github.com/hashicorp/vault"],"sourceUrl":"https://github.com/advisories/GHSA-vp5w-xcfc-73wf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vp5w-xcfc-73wf","identifiers":["GHSA-vp5w-xcfc-73wf","BIT-vault-2025-12044","CVE-2025-12044","GO-2025-4071"]},"retained":false,"historicalAffected":[]}],"coverage":[]}