CVE-2025-4656
Vault Vulnerable to Recovery Key Cancellation Denial of Service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Vault Vulnerable to Recovery Key Cancellation Denial of Service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
CVE-2025-4656- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1088
- Updated
- 2026-11-02
EUVDEUVD-2025-28064
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
EUVD-2025-28064- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fhc2-8qx8-6vj7
Vault Community Edition rekey and recovery key operations can cause denial of service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
GHSA-fhc2-8qx8-6vj7- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1088
- Updated
- 2026-11-02
NVD
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
CVE-2025-4656- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1088
- Updated
- 2026-11-02
OSV
Vault Vulnerable to Recovery Key Cancellation Denial of Service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
CVE-2025-4656- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1088
- Updated
- 2026-11-02
OSVGHSA-fhc2-8qx8-6vj7
Vault Community Edition rekey and recovery key operations can cause denial of service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
GHSA-fhc2-8qx8-6vj7- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-1088
- Updated
- 2026-11-02
Show 4 moreShow less
OSVBIT-vault-2025-4656 No score
Vault Vulnerable to Recovery Key Cancellation Denial of Service
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
- Record
BIT-vault-2025-4656- Updated
- 2026-11-02
OSVGO-2025-3788 No score
Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
Vault Community Edition rekey and recovery key operations can cause denial of service in github.com/hashicorp/vault
- Record
GO-2025-3788- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15254-1 No score
openbao-2.3.1-1.1 on GA media
These are all security issues fixed in the openbao-2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15254-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/hashicorp/vaultGo |
1.14.8 up to 1.20.0 | 1.20.0 |
vaultBitnami |
1.14.8 up to 1.20.0 | 1.20.0 |
openbaoopenSUSE:Tumbleweed |
before 2.3.1-1.1 | 2.3.1-1.1 |
govulncheck-vulndbopenSUSE:Tumbleweed |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-4656 is a low vulnerability (CVSS 3.1) in Hashicorp Vault, published June 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in github.com/hashicorp/vault 1.20.0.
References
discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570
nvd.nist.gov/vuln/detail/CVE-2025-4656
github.com/hashicorp/vault/pull/30794
Show 56 moreShow less
suse.com/security/cve/CVE-2025-4656