Introduction
A single malformed payload can bring down a critical secrets management cluster, and with it the authentication and automation workflows of an entire organization. CVE-2025-6203 shows that resource exhaustion attacks remain a risk in widely deployed infrastructure tools.
HashiCorp Vault is an open source and commercial secrets management solution, used by thousands of organizations to secure credentials, API keys, and encryption material. Many cloud-native and DevOps environments are built on Vault, so a vulnerability in its core request handling logic has a high impact.
Technical information
CVE-2025-6203 is a denial of service vulnerability in HashiCorp Vault. An attacker can submit a specially crafted complex payload that stays within the default request size limit. When Vault processes the payload, it consumes excessive memory and CPU resources. The result is a timeout in the auditing subroutine, which may leave the Vault server unresponsive.
The root cause is insufficient resource allocation controls in Vault's request processing pipeline, the weakness described by CWE-770 (Allocation of Resources Without Limits or Throttling). Because of it, a small but complex input can trigger disproportionately high resource usage. No public code snippets or proof of concept are available for this issue.
Affected systems and versions
- HashiCorp Vault Community Edition prior to 1.20.3
- HashiCorp Vault Enterprise prior to 1.20.3, 1.19.9, 1.18.14, and 1.16.25
- All default configurations are vulnerable unless patched
Vendor security history
HashiCorp Vault has had several high-severity vulnerabilities in 2025, including remote code execution (CVE-2025-6000), user lockout bypass (CVE-2025-6004), and privilege escalation issues. HashiCorp typically issues patches and advisories quickly, communicates openly, and credits external security researchers. The repeated resource exhaustion and input validation flaws, though, suggest ongoing architectural problems in Vault's core logic.
