Executive brief
HashiCorp Boundary, a tool used to manage secure access to infrastructure, contains a flaw in how its 'worker' nodes handle new connections. An attacker can intentionally stall the security handshake process, which causes the system to stop processing other legitimate requests. This can lead to a service outage where authorized users and systems are unable to connect to the network resources managed by Boundary.
Technical details
HashiCorp Boundary workers are susceptible to a Denial of Service (DoS) vulnerability (CWE-770) during the node enrollment process. The root cause is a synchronous TLS handshake implementation in the worker authentication listener. An unauthenticated remote attacker can initiate a mutual TLS handshake and then delay or withhold the required client certificate. Because the connection handling path is blocked while waiting for the handshake to complete, the worker becomes unable to accept or route legitimate traffic. This issue is resolved in Boundary versions 0.19.5, 0.20.3, and 0.21.3.
Affected products
- HashiCorp Boundary < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3
- HashiCorp Boundary Enterprise < 0.19.5, 0.20.0 to < 0.20.3, 0.21.0 to < 0.21.3
Timeline
- 2026-05-04: disclosed: Initial disclosure by HashiCorp
- 2026-05-04: patched: Fixes released in versions 0.19.5, 0.20.3, and 0.21.3
- 2026-05-05: advisory: GitHub Advisory published