# \#security-boundary
**URL:** https://discuss.hashicorp.com/tag/security-boundary/77.md
[Latest](https://discuss.hashicorp.com/latest.md) · [Categories](https://discuss.hashicorp.com/categories.md) · [Tags](https://discuss.hashicorp.com/tags.md)
---
## [HCSEC-2026-11 - Boundary Workers Vulnerable to Denial of Service During TLS Handshake](https://discuss.hashicorp.com/t/hcsec-2026-11-boundary-workers-vulnerable-to-denial-of-service-during-tls-handshake/77403)
**Author:** [@mark.collao](https://discuss.hashicorp.com/u/mark.collao)\
**Replies:** 0\
**Last updated:** [May 4, 2026, 9:39pm UTC](https://discuss.hashicorp.com/t/hcsec-2026-11-boundary-workers-vulnerable-to-denial-of-service-during-tls-handshake/77403 "2026-05-04T21:39:44Z")
Bulletin ID: HCSEC-2026-11 Affected Products / Versions: Boundary Community Edition and Boundary Enterprise up to 0.21.2, 0.20.2, 0.19.4, fixed in 0.21.3, 0.20.3, 0.19.5 Publication Date: May 4th, 2026 Summary Bounda…
---
## [HCSEC-2024-28 - Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service](https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service/71944)
**Author:** [@mark.collao](https://discuss.hashicorp.com/u/mark.collao)\
**Replies:** 0\
**Last updated:** [December 12, 2024, 10:38pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service/71944 "2024-12-12T22:38:18Z")
Bulletin ID: HCSEC-2024-28 Affected Products / Versions: Boundary Community Edition and Boundary Enterprise 0.8.0 up to 0.18.1; fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2. Public…
---
## [HCSEC-2024-02 - Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering](https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Replies:** 0\
**Last updated:** [February 5, 2024, 6:49pm UTC](https://discuss.hashicorp.com/t/hcsec-2024-02-boundary-vulnerable-to-session-hijacking-through-tls-certificate-tampering/62458 "2024-02-05T18:49:11Z")
Bulletin ID: HCSEC-2024-02 Affected Products / Versions: Boundary and Boundary Enterprise since 0.8.0; fixed in 0.15.0. Publication Date: February 5, 2024 Summary Boundary and Boundary Enterprise (“Boundary”) is vuln…
---
## [HCSEC-2023-32 - Vault, Consul, and Boundary Affected By HTTP/2 “Rapid Reset” Denial of Service Vulnerability (CVE-2023-44487)](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Replies:** 0\
**Last updated:** [November 2, 2023, 10:19pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715 "2023-11-02T22:19:10Z")
Bulletin ID: HCSEC-2023-32 Affected Products / Versions: Vault and Vault Enterprise; vulnerable components updated in 1.15.1, 1.14.5, and 1.13.9. Consul and Consul Enterprise; vulnerable components updated in 1.16.3, …
---
## [HCSEC-2023-03 - Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured](https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Replies:** 0\
**Last updated:** [February 8, 2023, 6:16pm UTC](https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907 "2023-02-08T18:16:24Z")
Bulletin ID: HCSEC-2023-03 Affected Products / Versions: Boundary 0.10.0 up to 0.11.2; fixed in 0.12.0. Publication Date: February 8, 2023 Summary A vulnerability in Boundary was identified such that when a Key Manag…
---
## [HCSEC-2023-02 - Vault, Consul, Boundary, and Waypoint Affected By Denial of Service in Go’s net/http (CVE-2022-41717)](https://discuss.hashicorp.com/t/hcsec-2023-02-vault-consul-boundary-and-waypoint-affected-by-denial-of-service-in-go-s-net-http-cve-2022-41717/49860)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Replies:** 0\
**Last updated:** [February 8, 2023, 12:58am UTC](https://discuss.hashicorp.com/t/hcsec-2023-02-vault-consul-boundary-and-waypoint-affected-by-denial-of-service-in-go-s-net-http-cve-2022-41717/49860 "2023-02-08T00:58:02Z")
Bulletin ID: HCSEC-2023-02 Affected Products / Versions: Vault and Vault Enterprise up to 1.10.9, 1.11.6, 1.12.2; fixed in 1.10.10, 1.11.7, 1.12.3. Consul and Consul Enterprise up to 1.12.7, 1.13.4, 1.14.2; fixed in 1…
---
## [HCSEC-2022-17 - Boundary Allowed Access To Host Sets And Credential Sources For Authorized Users Of Another Scope](https://discuss.hashicorp.com/t/hcsec-2022-17-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493)
**Author:** [@eastebry](https://discuss.hashicorp.com/u/eastebry)\
**Replies:** 0\
**Last updated:** [August 23, 2022, 10:32pm UTC](https://discuss.hashicorp.com/t/hcsec-2022-17-boundary-allowed-access-to-host-sets-and-credential-sources-for-authorized-users-of-another-scope/43493 "2022-08-23T22:32:03Z")
Bulletin ID: HCSEC-2022-17 Affected Products / Versions: Boundary up to 0.10.1; fixed in 0.10.2. Publication Date: August 23, 2022 Summary HashiCorp Boundary versions up to 0.10.1 did not properly perform data integr…
---
## [HCSEC-2021-34 - Vault, Consul, Boundary, and Waypoint Affected By Denial of Service in Golang’s net/http (CVE-2021-44716)](https://discuss.hashicorp.com/t/hcsec-2021-34-vault-consul-boundary-and-waypoint-affected-by-denial-of-service-in-golang-s-net-http-cve-2021-44716/33527)
**Author:** [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Replies:** 0\
**Last updated:** [December 22, 2021, 11:42pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-34-vault-consul-boundary-and-waypoint-affected-by-denial-of-service-in-golang-s-net-http-cve-2021-44716/33527 "2021-12-22T23:42:48Z")
Bulletin ID: HCSEC-2021-34 Affected Products / Versions: Vault and Vault Enterprise up to 1.7.7, 1.8.6, 1.9.1; fixed in 1.7.8, 1.8.7 and 1.9.2. Consul and Consul Enterprise up to 1.8.18, 1.9.12, 1.10.5, 1.11.0; fixed …