CVE-2025-12044: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

CVE-2025-12044 · Severity: high · CVSS 7.5 · Published 2025-10-23

Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393]  which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

Technologies: github.com/hashicorp/vault (Go), HashiCorp Vault. Vendors: Go, HashiCorp.

Quick answers

Is CVE-2025-12044 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-12044 being exploited in the wild.
How severe is CVE-2025-12044?
High severity, with a CVSS score of 7.5, published 23 October 2025.
Which products and versions are affected?
github.com/hashicorp/vault (Go) SEMVER:introduced=1.20.3,fixed=1.21.0.
Is there a fix for CVE-2025-12044?
Yes. github.com/hashicorp/vault (Go): upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-12044?
Check whether you run github.com/hashicorp/vault (Go) or HashiCorp Vault at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/hashicorp/vault (Go): upgrade to 1.21.0 or later
    go get github.com/hashicorp/vault@v1.21.0

Affected products

  • github.com/hashicorp/vault (Go) SEMVER:introduced=1.20.3,fixed=1.21.0
  • HashiCorp Vault

Identifiers

  • CVE-2025-12044
  • GHSA-vp5w-xcfc-73wf
  • GO-2025-4071

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.