CVE-2025-12044: Hashicorp Vault Denial of Service Vulnerability in JSON Processing
Summary
CVE-2025-12044: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON. Affects github.com/hashicorp/vault versions >= 1.20.3, < 1.21.0. Fixed in 1.21.0. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2025-12044 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Vault is a tool designed for securely accessing secrets, managing sensitive data, and providing a unified interface for secret management. It is widely used in cloud environments to protect sensitive information. However, it has been found to be vulnerable to a denial of service attack when processing complex JSON payloads, which can lead to service disruptions.
Vulnerability Detail
The vulnerability, identified as CVE-2025-12044, arises from a regression in Vault's handling of JSON payloads. This issue allows an unauthenticated attacker to exploit the system by sending specially crafted JSON requests, which can overwhelm the service and lead to a denial of service. The vulnerability stems from a failure to apply rate limits before processing these payloads, a flaw that was introduced in a previous fix.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.21.0
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement rate limiting on their own to mitigate the risk of denial of service attacks until they can upgrade to the patched version.
Conclusion
CVE-2025-12044 represents a significant security risk for users of Hashicorp Vault, allowing for potential denial of service through JSON payloads. It is crucial for users to update to the latest patched versions to safeguard their systems against this vulnerability.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2025-12044 is a vulnerability in Hashicorp Vault that allows for unauthenticated denial of service through complex JSON payloads.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors vulnerabilities in real-time.
The vulnerability affects Vault versions prior to 1.21.0 for the Community Edition and earlier versions for the Enterprise Edition.
If immediate updating is not possible, consider implementing rate limiting on your JSON payloads to reduce the risk of denial of service.
The CVSS score for CVE-2025-12044 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
