An unauthenticated remote attacker can trigger a denial of service condition in OpenBao by submitting a specially crafted JSON payload that causes uncontrolled memory consumption.

This vulnerability is an instance of uncontrolled resource consumption (CWE-400) where the application deserializes JSON objects into memory without sufficient validation. Because the request body is parsed before authentication, an unauthenticated attacker can force the system to allocate excessive memory, effectively bypassing the max_request_size configuration parameter.

The ability for an unauthenticated attacker to cause an out of memory crash directly impacts the availability of the secrets management system. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to business operations, as it allows for the disruption of critical identity and secret management services without requiring user interaction or valid credentials.

Immediate Action: Upgrade OpenBao to version 2.4.1 or later to implement the necessary fixes for JSON deserialization and resource management.

Proactive Monitoring: Monitor system logs and infrastructure metrics for frequent application crashes or sudden spikes in memory and CPU usage that correlate with incoming network requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway configured to inspect and limit the size and complexity of incoming JSON payloads to prevent malicious requests from reaching the application backend.

Public Exploit Available: No

Organizations utilizing OpenBao must prioritize the upgrade to version 2.4.1 to mitigate this risk. Given that the vulnerability is exploitable by unauthenticated remote parties, failure to patch leaves the identity infrastructure exposed to trivial denial of service attacks that could result in widespread operational downtime.