CVE-2025-6203: HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads

August 28, 2025 (updated August 29, 2025)

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.

References

discuss.hashicorp.com/
discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393
github.com/advisories/GHSA-8f82-53h8-2p34
github.com/hashicorp/vault
github.com/hashicorp/vault/commit/eedc2b7426f30e57e306229ce697ce81e203ab89
nvd.nist.gov/vuln/detail/CVE-2025-6203

Code Behaviors & Features

Detect and mitigate CVE-2025-6203 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →