OpenBao vulnerable to denial of service via malicious JSON request processing

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-59043 · Microsoft / collected KEV context

EUVD-2025-34895

GHSA-g46h-2rq9-gw5m

BIT-openbao-2025-59043

GO-2025-4039

cve-program · CVE-2025-59043

• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m
• https://github.com/openbao/openbao/pull/1756
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50

euvd · EUVD-2025-34895

• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m
• https://github.com/openbao/openbao/pull/1756
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50

nvd · CVE-2025-59043

• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c
• https://github.com/openbao/openbao/pull/1756
• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m

osv · GHSA-g46h-2rq9-gw5m

• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m
• https://nvd.nist.gov/vuln/detail/CVE-2025-59043
• https://nvd.nist.gov/vuln/detail/CVE-2025-6203
• https://github.com/openbao/openbao/pull/1756
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c
• https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393
• https://github.com/openbao/openbao
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50

osv · GO-2025-4039

• https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m
• https://nvd.nist.gov/vuln/detail/CVE-2025-59043
• https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c
• https://github.com/openbao/openbao/pull/1756
• https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393
• https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50
• https://nvd.nist.gov/vuln/detail/CVE-2025-6203

No related operational record is retained in the current change model.