{"id":"CVE-2023-6337","aliases":["AZL-34585","BIT-vault-2023-6337","EUVD-2023-3128","GHSA-6p62-6cg9-f5f5","GO-2023-2399"],"status":"published","title":"Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00792,"percentile":0.56585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2023-12-08T21:12:31Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.15.4","1.14.8","1.13.12"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"cert-manager","fixed_in":["1.12.12-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.13.12","1.14.8","1.15.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.13.12"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cert-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.12-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.12"},{"introduced":"1.14.0"},{"fixed":"1.14.8"},{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.14.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.13.12"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.12.0"},{"fixed":"1.13.12"},{"introduced":"1.14.0"},{"fixed":"1.14.8"},{"introduced":"1.15.0"},{"fixed":"1.15.4"}]}]}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240112-0006/","tags":["x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6337","tags":["web","advisory"]},{"url":"https://github.com/hashicorp/vault/pull/24354","tags":["web","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20240112-0006","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6p62-6cg9-f5f5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6337.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-6337","title":"Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-08T21:12:31.712Z","modified":"2025-02-13T17:26:18.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-3128","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-08T21:12:31Z","modified":"2025-02-13T17:26:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:47.607822Z"}],"ghsa":[{"id":"GHSA-6p62-6cg9-f5f5","title":"Memory exhaustion in HashiCorp Vault","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-09T00:35:05Z","modified":"2025-02-13T19:28:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2023-6337","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-08T22:15:07.713Z","modified":"2026-06-17T06:50:33.59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:08:54.010507Z"}],"osv":[{"id":"AZL-34585","title":"CVE-2023-6337 affecting package cert-manager for versions less than 1.12.12-1","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-08T22:15:07Z","modified":"2026-04-21T04:32:14.036184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"CVE-2023-6337","title":"Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-08T21:12:31.712Z","modified":"2026-10-28T02:30:34.317249211Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"GHSA-6p62-6cg9-f5f5","title":"Memory exhaustion in HashiCorp Vault","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2023-12-09T00:35:05Z","modified":"2025-02-13T19:28:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"BIT-vault-2023-6337","title":"Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests","description":"HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash.\n\nFixed in Vault 1.15.4, 1.14.8, 1.13.12.","status":"published","published":"2024-03-06T11:08:02.584Z","modified":"2026-09-08T08:48:21.560131098Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2023-2399","title":"Denial of service via memory exhaustion in github.com/hashicorp/vault","description":"Unauthenticated and authenticated HTTP requests from a client will be attempted to be mapped to memory. Large requests may result in the exhaustion of available memory on the host, which may cause crashes and denial of service.","status":"published","published":"2024-01-03T22:56:19Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}