CVE-2024-8185
Vault Vulnerable to Denial of Service When Processing Raft Join Requests
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Vault Vulnerable to Denial of Service When Processing Raft Join Requests
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.
Reserved 2024-08-26 | Published 2024-10-31 | Updated 2024-10-31 | Assigner HashiCorpCWE-636: Not Failing Securely (Failing Open)
discuss.hashicorp.com/...ng-raft-cluster-join-requests/71047
Support options
