Introduction
A denial-of-service attack on secrets management infrastructure can halt application deployments, disrupt credential rotation, and break the automated workflows that organizations depend on. CVE-2025-12044 is a high-severity flaw in HashiCorp Vault and Vault Enterprise that lets unauthenticated attackers exhaust system resources simply by sending repeated JSON API requests. It comes from a regression in the request processing pipeline, where rate limiting was incorrectly applied after the expensive JSON parsing step.
HashiCorp is a major provider of infrastructure automation tools, and Vault is widely used for secrets management, encryption as a service, and privileged access workflows. Thousands of organizations around the world deploy Vault, in industries including finance and technology, and it is a core part of many cloud and on-premises security architectures. That makes a denial-of-service flaw in Vault a serious problem, one that could reach a wide range of critical infrastructure.
Technical information
CVE-2025-12044 is a regression that appeared after the fix for CVE-2025-6203 (HCSEC-2025-24). The original vulnerability let attackers send complex but valid JSON payloads that stayed under the maximum request size yet consumed excessive CPU and memory during parsing and audit operations. To mitigate it, HashiCorp added listener configuration parameters that limit JSON structure complexity, such as maximum nesting depth and string length.
The fix unintentionally left a gap. In affected versions, Vault parses the JSON payload before it applies rate limiting. An attacker can send repeated HTTP requests with valid, resource-intensive JSON bodies, and Vault parses each one, spending system resources, before the rate limiter checks whether the client has exceeded its quota. An unauthenticated attacker only has to send enough requests to exhaust CPU and memory, which may degrade performance or cause a service outage.
The vulnerability is classified as CWE-770: Allocation of Resources Without Limits or Throttling. The attack needs only network access to the Vault API endpoint, with no authentication or special privileges. The patched versions correct the request processing order so that Vault enforces rate limiting before it parses JSON.
Affected systems and versions
The following versions are affected:
Vault Community Edition:
- Versions 1.20.3 through 1.20.4
Vault Enterprise:
- Versions 1.20.3 through 1.20.4
- Versions 1.19.9 through 1.19.10
- Versions 1.18.14 through 1.18.15
- Versions 1.16.25 through 1.16.26
Fixed versions:
- Vault Community Edition 1.21.0
- Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0
Any configuration that exposes Vault API endpoints to network access is affected, especially where those endpoints are reachable from untrusted networks.
Vendor security history
HashiCorp has previously fixed a similar denial-of-service vulnerability in Vault involving complex JSON payloads (CVE-2025-6203, HCSEC-2025-24). A related issue coming back as a regression shows how hard it is to change request processing logic securely. HashiCorp's security advisories are transparent, and the company ships patches across multiple supported version lines, which reflects a mature response process. Still, this sequence of related vulnerabilities makes it clear that regression testing and validation need to improve.
