CVE-2025-6203: Denial of Service Vulnerability in HashiCorp Vault Due to Complex JSON Payloads
Summary
CVE-2025-6203: HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads in github.com/hashicorp/vault. Affects github.com/hashicorp/vault versions < 1.20.3. Fixed in 1.20.3. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2025-6203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a widely-used open-source tool designed for securely accessing secrets, managing sensitive data, and providing identity-based access to applications. It offers features such as dynamic secrets, data encryption, and identity management. However, it is vulnerable to a Denial of Service (DoS) attack when processing complex JSON payloads, which can lead to service disruption.
Vulnerability Detail
The vulnerability identified as CVE-2025-6203 in HashiCorp Vault arises from the handling of complex JSON payloads. Attackers can exploit this flaw to craft specific payloads that overwhelm the Vault service, leading to a Denial of Service. This can result in the service becoming unresponsive, affecting all users and applications relying on Vault for secret management. The vulnerability is present in all versions prior to 1.20.3.
How To Fix
Latest published version: v1.21.4 as of 23 Oct 2026
go get github.com/hashicorp/vault@v1.21.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.20.3
This is the first release that contains the fix.
go get github.com/hashicorp/vault@v1.20.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on incoming requests to the Vault service to mitigate the impact of potential attacks while you prepare to upgrade to the patched version.
Conclusion
The CVE-2025-6203 vulnerability in HashiCorp Vault poses a significant risk of Denial of Service through complex JSON payloads. It is crucial for users to upgrade to version 1.20.3 or later to mitigate this risk. Implementing temporary workarounds can help reduce exposure until an upgrade can be performed.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
CVE-2025-6203 is a Denial of Service vulnerability in HashiCorp Vault that can be exploited through complex JSON payloads.
If your application relies on HashiCorp Vault, it may become unresponsive if an attacker exploits this vulnerability, leading to service disruption.
All versions of HashiCorp Vault prior to 1.20.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If an immediate upgrade is not possible, consider implementing rate limiting on requests to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
