CVE-2023-5954
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
CVE-2023-5954- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2023-2881
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
EUVD-2023-2881- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qhc-v8r6-8vwm
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
GHSA-4qhc-v8r6-8vwm- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
NVD
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
CVE-2023-5954- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
CVE-2023-5954- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVGHSA-4qhc-v8r6-8vwm
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
GHSA-4qhc-v8r6-8vwm- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVBIT-vault-2023-5954 No score
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- Record
BIT-vault-2023-5954- Updated
- 2026-11-02
OSVGO-2023-2329 No score
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
- Record
GO-2023-2329- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hashicorp/vaultGo |
before 1.13.10 | 1.13.10 |
github.com/hashicorp/vaultGo |
1.14.0 up to 1.14.6 | 1.14.6 |
github.com/hashicorp/vaultGo |
1.15.0 up to 1.15.2 | 1.15.2 |
vaultBitnami |
1.13.7 up to 1.13.10, 1.14.3 up to 1.14.6, 1.15.0 up to 1.15.2 | 1.13.101.14.61.15.2 |
github.com/hashicorp/vaultGo |
before 1.13.10, 1.14.0 up to 1.14.6, 1.15.0 up to 1.15.2 | 1.13.101.14.61.15.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5954 is a medium vulnerability (CVSS 5.9) in Hashicorp Vault, published November 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in github.com/hashicorp/vault 1.13.10.
References
discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926
security.netapp.com/advisory/ntap-20231227-0001
nvd.nist.gov/vuln/detail/CVE-2023-5954
github.com/advisories/GHSA-4qhc-v8r6-8vwm