cve.bz

CVE-2023-6337

7.5 highEPSS 0.8%

High (7.5) in hashicorp vault. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.13.12, 1.14.8, 1.15.4.

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
CWE
CWE-770
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6p62-6cg9-f5f5Gogithub.com/hashicorp/vault>=1.15.0 <1.15.41.15.4
GHSA-6p62-6cg9-f5f5Gogithub.com/hashicorp/vault>=1.14.0 <1.14.81.14.8
GHSA-6p62-6cg9-f5f5Gogithub.com/hashicorp/vault>=1.12.0 <1.13.121.13.12
GO-2023-2399Gogithub.com/hashicorp/vault>=1.12.0 <1.13.12
>=1.14.0 <1.14.8
>=1.15.0 <1.15.4		1.13.12, 1.14.8, 1.15.4

References

Check your stackJSON