CVE-2025-6203: HashiCorp Vault Denial of Service via Complex JSON Payloads
Summary
CVE-2025-6203: HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads. Affects github.com/hashicorp/vault versions < 1.20.3. Fixed in 1.20.3. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2025-6203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a tool designed for securely accessing secrets, managing sensitive data, and providing identity-based access to applications. It is widely used for managing secrets in cloud environments and on-premises infrastructures. The package is known for its robust security features, but it is not immune to vulnerabilities, such as the one described here, which can lead to service disruptions.
Vulnerability Detail
CVE-2025-6203 is a vulnerability in HashiCorp Vault that allows a malicious user to submit a specially-crafted complex payload that meets the default request size limit. This can lead to excessive memory and CPU consumption, causing timeouts in Vault's auditing subroutine. As a result, the Vault server may become unresponsive, impacting the availability of the service. The vulnerability arises from inadequate handling of complex requests, which can overwhelm the system resources.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.3
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.20.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on incoming requests to mitigate the impact of complex payloads. This can be done by configuring your API gateway or load balancer to restrict the size and frequency of requests.
Conclusion
CVE-2025-6203 represents a significant vulnerability in HashiCorp Vault that can lead to denial of service through complex JSON payloads. It is crucial for users to update to the latest patched versions to mitigate the risk and ensure the availability of their services.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2025-6203 is a vulnerability in HashiCorp Vault that can lead to denial of service due to excessive resource consumption from complex JSON payloads.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The vulnerability can cause Vault to become unresponsive, leading to potential downtime and disruption of services that rely on Vault for secret management.
Yes, the vulnerability is fixed in Vault Community Edition 1.20.3 and Vault Enterprise versions 1.20.3, 1.19.9, 1.18.14, and 1.16.25.
The CVSS score for CVE-2025-6203 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
