CVE-2023-5954
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
Las solicitudes de clientes entrantes de HashiCorp Vault y Vault Enterprise que activan una verificación de políticas pueden provocar un consumo ilimitado de memoria. Un gran número de estas solicitudes pueden dar lugar a una denegación de servicio. Corregido en Vault 1.15.2, 1.14.6 y 1.13.10.
A flaw was found in The HashiCorp Vault, which may be susceptible to a denial of service due to an unbounded consumption of memory when handling policy requests. This issue may allow an attacker to trigger policy checks by sending multiple inbound client requests that create a logger that is never removed from memory, leading to excessive memory consumption, causing a denial of service condition.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-11-03 CVE Reserved
- 2023-11-09 CVE Published
- 2024-08-02 CVE Updated
- 2024-11-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-401: Missing Release of Memory after Effective Lifetime
CAPEC
References (4)
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.13.7 < 1.13.10 Search vendor "Hashicorp" for product "Vault" and version " >= 1.13.7 < 1.13.10" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.13.7 < 1.13.10 Search vendor "Hashicorp" for product "Vault" and version " >= 1.13.7 < 1.13.10" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.14.3 < 1.14.6 Search vendor "Hashicorp" for product "Vault" and version " >= 1.14.3 < 1.14.6" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.14.3 < 1.14.6 Search vendor "Hashicorp" for product "Vault" and version " >= 1.14.3 < 1.14.6" | enterprise |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.15.0 < 1.15.2 Search vendor "Hashicorp" for product "Vault" and version " >= 1.15.0 < 1.15.2" | - |
Affected
| ||||||
| Hashicorp Search vendor "Hashicorp" | Vault Search vendor "Hashicorp" for product "Vault" | >= 1.15.0 < 1.15.2 Search vendor "Hashicorp" for product "Vault" and version " >= 1.15.0 < 1.15.2" | enterprise |
Affected
| ||||||