{"id":"CVE-2023-5954","aliases":["BIT-vault-2023-5954","EUVD-2023-2881","GHSA-4qhc-v8r6-8vwm","GO-2023-2329"],"status":"published","title":"Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00885,"percentile":0.59556,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2023-11-09T20:13:49Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.13.10","1.14.6","1.15.2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.13.10","1.14.6","1.15.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.7"},{"fixed":"1.13.10"},{"introduced":"1.14.3"},{"fixed":"1.14.6"},{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.10"},{"introduced":"1.14.0"},{"fixed":"1.14.6"},{"introduced":"1.15.0"},{"fixed":"1.15.2"}]}]}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231227-0001/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5954","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4qhc-v8r6-8vwm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5954.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20231227-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-5954","title":"Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T20:13:49.346Z","modified":"2025-02-13T17:25:58.499Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-2881","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T20:13:49Z","modified":"2025-02-13T17:25:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:47.607822Z"}],"ghsa":[{"id":"GHSA-4qhc-v8r6-8vwm","title":"HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T21:30:39Z","modified":"2024-01-05T05:05:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2023-5954","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T21:15:25.143Z","modified":"2026-06-17T06:49:44.13Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:08:46.647045Z"}],"osv":[{"id":"CVE-2023-5954","title":"Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T20:13:49.346Z","modified":"2026-10-28T02:30:40.456191329Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"GHSA-4qhc-v8r6-8vwm","title":"HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2023-11-09T21:30:39Z","modified":"2026-09-10T03:50:04.037645183Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"BIT-vault-2023-5954","title":"Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption","description":"HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.","status":"published","published":"2024-03-06T11:08:11.6Z","modified":"2026-09-08T08:48:21.628193009Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2023-2329","title":"HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault","description":"HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault","status":"published","published":"2024-08-21T14:30:22Z","modified":"2026-02-04T03:33:38.137053Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}