CVE-2025-6203
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault's auditing subroutine, potentially resulting in the Vault server to become unresponsive.
Risk Assessment
An attacker can cause resource exhaustion and unresponsiveness of the Vault server, disrupting access to managed secrets and affecting business continuity.
Recommendation
Update Vault Community Edition to 1.20.3 and Vault Enterprise to 1.20.3, 1.19.9, 1.18.14, or 1.16.25. Consider adjusting request size limits and monitoring resource usage.
Other vulnerabilities in HashiCorp Vault
See all- CVE-2026-5006Medium
HashiCorp Vault and Vault Enterprise have a vulnerability allowing an authenticated attacker to manipulate an identity value referenced by a templated policy path to gain unintended access. Slash characters can be interpreted as additional path segments. Fixed in Vault CE 2.0.4 and Enterprise 2.0.4, 1.21.9, 1.20.14, 1.19.20.
- CVE-2026-5051Medium
In HashiCorp Vault and Vault Enterprise prior to version 2.0.1, the audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability is fixed in versions 2.0.1, 1.21.6, 1.20.11, and 1.19.17.
- CVE-2026-3605High
An authenticated user with access to a kvv2 path through a policy containing a glob may delete secrets they were not authorized to read or write, causing denial-of-service. This vulnerability does not allow cross-namespace deletion or reading of secret data.
Original NVD description (English source)
A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS