# HCSEC-2025-31- Vault Vulnerable to Denial of Service Due to Rate Limit Regression

**URL:** <https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [October 23, 2025, 7:14pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710 "2025-10-23T19:14:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mark.collao](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mark.collao/32/23944_2.png) [@mark.collao](https://discuss.hashicorp.com/u/mark.collao)\
**Post date:** [October 23, 2025, 7:14pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-31-vault-vulnerable-to-denial-of-service-due-to-rate-limit-regression/76710/1 "2025-10-23T19:14:22Z")

</div>

**Bulletin ID:** HCSEC-2025-31  
**Affected Products / Versions:** Vault Community Edition 1.20.3 to 1.20.4; fixed in 1.21.0.  
Vault Enterprise 1.20.3 to 1.20.4, 1.19.9 to 1.19.10, 1.18.14 to 1.18.15, 1.16.25 to 1.16.26; fixed in 1.21.0, 1.20.5, 1.19.11, and 1.16.27  
**Publication Date:** October 23, 2025

**Summary**  
Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [HCSEC-2025-24](https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393) which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

**Background**  
Vault allows operators to configure [tunable rate limits](https://developer.hashicorp.com/vault/docs/concepts/resource-quotas#rate-limit-quotas) and other resource quotas. Due to a regression from the [HCSEC-2025-24](https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393) fix, rate limits were applied after JSON payload processing rather than before, enabling resource exhaustion.

**Details**  
Every request in Vault is subject to configurable rate limits. In [HCSEC-2025-24](https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393), Vault fixed processing complex JSON payloads which may exhaust underlying resources depending on the payload. In affected versions, Vault accepted large but valid JSON requests below the [max\_request\_size](https://developer.hashicorp.com/vault/docs/internals/limits?#request-size) threshold. Because rate limiting occurred post-parse, repeated payloads could consume CPU and memory resources, resulting in service unavailability or crashes.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Vault Community Edition 1.21.0 or Vault Enterprise 1.21.0, 1.19.11, and 1.16.27. Please refer to [Upgrading Vault](https://developer.hashicorp.com/vault/docs/upgrading) for general guidance.

**Acknowledgement**  
This issue was identified by Toni Tauro of Adfinis AG.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._