title: Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
description: HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
problem types: CWE-401: Missing Release of Memory after Effective Lifetime
affected:
{
vendor: HashiCorp
product: Vault
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 1.15.0
status: affected, version: 1.15.1
status: affected, version: 1.14.3
status: affected, version: 1.14.4
status: affected, version: 1.14.5
status: affected, version: 1.13.7
status: affected, version: 1.13.8
status: affected, version: 1.13.9
defaultStatus: unaffected
}
{
vendor: HashiCorp
product: Vault Enterprise
platforms: [Windows, MacOS, Linux, x86, ARM, 64 bit, 32 bit]
versions:
status: affected, version: 1.15.0
status: affected, version: 1.15.1
status: affected, version: 1.14.3
status: affected, version: 1.14.4
status: affected, version: 1.14.5
status: affected, version: 1.13.7
status: affected, version: 1.13.8
status: affected, version: 1.13.9
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
]