CVE-2025-12044: HashiCorp Vault DOS Vulnerability

CVE-2025-12044 Overview

CVE-2025-12044 is a denial of service vulnerability affecting HashiCorp Vault and Vault Enterprise. The vulnerability allows unauthenticated attackers to cause service disruption by sending specially crafted JSON payloads that are processed before rate limiting controls are applied. This issue stems from a regression introduced after a previous security fix (HCSEC-2025-24) that was intended to address similar denial of service concerns through complex JSON payloads.

Critical Impact

Unauthenticated attackers can remotely disrupt Vault services by exploiting the rate limit bypass, potentially causing secrets management infrastructure to become unavailable and impacting dependent applications and services.

Affected Products

• HashiCorp Vault Community Edition (versions prior to 1.21.0)
• HashiCorp Vault Enterprise (versions prior to 1.16.27, 1.19.11, 1.20.5, and 1.21.0)
• HashiCorp Vault Enterprise across multiple version branches

Discovery Timeline

• 2025-10-23 - CVE-2025-12044 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2025-12044

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in the improper ordering of request processing, where JSON payload parsing occurs before rate limiting controls are enforced. This architectural flaw allows an attacker to submit resource-intensive JSON payloads that consume server resources without being subject to the protective rate limiting mechanisms designed to prevent such abuse.

The vulnerability represents a regression from a previous fix (HCSEC-2025-24), indicating that changes made to address the original denial of service issue inadvertently reintroduced a variant of the same problem. The attack can be executed remotely over the network without requiring any authentication, making it particularly dangerous for internet-exposed Vault instances.

Root Cause

The root cause is a regression in the request processing pipeline where the rate limiting middleware is applied after JSON payload parsing has already begun. This means malicious payloads designed to consume excessive CPU or memory resources during parsing are processed regardless of whether the sender has exceeded rate limits. The fix in HCSEC-2025-24 intended to prevent this, but subsequent code changes caused the vulnerability to resurface.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker can send multiple HTTP requests containing complex or malformed JSON payloads to any Vault API endpoint that accepts JSON input. Since rate limits are not applied before payload processing begins, the server will expend resources parsing these payloads, potentially leading to resource exhaustion and service unavailability.

The exploitation mechanism involves crafting JSON payloads with deeply nested structures, extremely long strings, or other characteristics that maximize parsing overhead. By sending a sufficient volume of such requests, an attacker can overwhelm the Vault server's processing capacity.

Detection Methods for CVE-2025-12044

Indicators of Compromise

• Unusual volume of HTTP requests to Vault API endpoints from single or distributed sources
• High CPU or memory utilization on Vault servers during periods of suspicious request activity
• Vault service degradation or unavailability correlating with spikes in API request volume
• Log entries showing parsing errors or timeouts for incoming JSON payloads

Detection Strategies

• Monitor Vault server resource utilization (CPU, memory) for anomalous spikes that may indicate DoS attempts
• Implement network-level traffic analysis to detect high-volume request patterns targeting Vault endpoints
• Configure alerting on Vault audit logs for unusual patterns of failed or slow requests
• Deploy web application firewalls (WAF) to inspect and filter malicious JSON payloads before they reach Vault

Monitoring Recommendations

• Enable detailed Vault audit logging to capture request metadata for forensic analysis
• Set up infrastructure monitoring dashboards focusing on Vault service health and availability metrics
• Implement distributed tracing to correlate request patterns with performance degradation
• Configure automated alerts for when Vault response times exceed normal thresholds

How to Mitigate CVE-2025-12044

Immediate Actions Required

• Upgrade HashiCorp Vault Community Edition to version 1.21.0 or later
• Upgrade HashiCorp Vault Enterprise to version 1.16.27, 1.19.11, 1.20.5, or 1.21.0 depending on your version branch
• Review network exposure of Vault instances and limit access to trusted networks where possible
• Implement external rate limiting at the load balancer or reverse proxy layer as a defense-in-depth measure

Patch Information

HashiCorp has released patched versions that address this denial of service vulnerability. The fix restores proper request processing order to ensure rate limits are applied before JSON payload parsing begins. Organizations should upgrade to the following versions:

• Vault Community Edition: 1.21.0
• Vault Enterprise 1.16.x branch: 1.16.27
• Vault Enterprise 1.19.x branch: 1.19.11
• Vault Enterprise 1.20.x branch: 1.20.5
• Vault Enterprise 1.21.x branch: 1.21.0

For detailed patch information, refer to the HashiCorp Security Advisory HCSEC-2025-31.

Workarounds

• Place Vault behind a reverse proxy or load balancer configured with strict rate limiting rules
• Implement network-level access controls to restrict Vault API access to authorized IP ranges only
• Deploy a web application firewall (WAF) with rules to detect and block oversized or malformed JSON payloads
• Consider temporarily reducing listener concurrency limits if upgrading is not immediately possible

# Example: Configure external rate limiting with HAProxy (defense-in-depth)
# Add to HAProxy frontend configuration
frontend vault_frontend
    bind *:8200
    # Stick table for rate limiting
    stick-table type ip size 100k expire 30s store http_req_rate(10s)
    # Track request rate per source IP
    http-request track-sc0 src
    # Deny if rate exceeds 100 requests per 10 seconds
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }
    default_backend vault_backend