HashiCorp Vault and Vault Enterprise are vulnerable to an unauthenticated denial of service attack that can be triggered by remote, unauthorized actors via malicious JSON payloads.

The vulnerability stems from an improper resource allocation (CWE-770) where JSON payloads are processed before rate limits are applied, allowing an unauthenticated attacker to cause a service crash.

A successful exploitation of this vulnerability results in a denial of service, rendering the Vault instance unavailable for legitimate users and applications. Given a CVSS score of 7.5, this represents a high-severity risk to business continuity, as Vault is often a critical component for managing secrets and sensitive credentials across infrastructure. The ability for unauthenticated actors to trigger this state remotely necessitates immediate attention to prevent operational disruption.

Immediate Action: Upgrade to HashiCorp Vault Community Edition 1.21.0 or the corresponding fixed Enterprise versions: 1.16.27, 1.19.11, 1.20.5, or 1.21.0.

Proactive Monitoring: Monitor system logs for unusual spikes in request frequency or recurring service restarts that may indicate attempted exploitation of the JSON parsing engine.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter complex or malformed JSON payloads directed at the Vault API endpoints, though this should be considered a temporary measure pending a software update.

Public Exploit Available: Unknown.

The risk posed by this vulnerability is significant due to the critical nature of Vault in enterprise environments and the ease with which an unauthenticated actor can trigger a denial of service. Security teams should prioritize patching affected instances immediately. If an immediate upgrade is not feasible, restrict network access to the Vault API to known, trusted IP ranges to reduce the attack surface.