CVE-2023-5954

highPriorität · verfolgen · 30EPSS 0.007 · 54. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 7.5 · high

Is it mine?

41 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security@hashicorp.comAusnutzbarkeit 2.2 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-401USprimärCWE-401USCWE-401US

betroffene Produkte (41)

Betroffene Produkte und Versionsbereiche.

Hashicorp Vault <1.13.10alle Versionencert_bundDE
Hashicorp Vault <1.14.6alle Versionencert_bundDE
Hashicorp Vault <1.15.2alle Versionencert_bundDE
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Hashicorp Vault< 1.13.10cert_bundDE
Hashicorp Vault< 1.14.6cert_bundDE
Hashicorp Vault< 1.15.2cert_bundDE
Vault≤ 1.14.5enisa_euvdEU
Vault≤ 1.13.7enisa_euvdEU
Vault≤ 1.14.3enisa_euvdEU
Vault≤ 1.14.4enisa_euvdEU
Vault≤ 1.13.9enisa_euvdEU
Vault≤ 1.15.1enisa_euvdEU
Vault≤ 1.15.0enisa_euvdEU
Vault≤ 1.13.8enisa_euvdEU
Vault Enterprise≤ 1.15.1enisa_euvdEU
Vault Enterprise≤ 1.14.3enisa_euvdEU
Vault Enterprise≤ 1.14.4enisa_euvdEU
Vault Enterprise≤ 1.14.5enisa_euvdEU
Vault Enterprise≤ 1.13.8enisa_euvdEU

20 von 41 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2023-2871Hashicorp Vault: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-11-09csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Denial of Service Angriff durchzuführen.
GHSA-4qhc-v8r6-8vwmHashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability2023-11-09ghsa · osvUS
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
BIT-vault-2023-5954Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption2024-03-06vendor · osvUS
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
GO-2023-2329HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault2024-08-21vendor · osvUS
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault

auch bekannt als (7)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2023-11-09geändert 2026-06-17

verwandt (3,014)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2023-26083US	low3.3OT kritisch	1.22% (68th)	KEV	2023-04-06
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall G…
CVE-2021-1906US	medium5.5OT kritisch	0.52% (44th)	KEV	2021-05-07
Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon C…
CVE-2018-0158US	high8.6OT kritisch	7.19% (94th)	KEV	2018-03-28
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a mem…
CVE-2023-25136US	medium6.5	89.8% (100th)	Exploit	2023-02-03
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unaut…
CVE-2016-4232US	high7.5	36.5% (98th)	Exploit	2016-07-13
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain sensitive information f…

+3009 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan