Description
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Vault | 1.14.8 – < 1.20.0 | 1.20.0 |
| HashiCorp | Vault Enterprise | 1.14.8 – < 1.20.0 | 1.20.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 | openSUSE-SU-2025:15405-1 |
| openSUSE Tumbleweed | openbao | 2.3.1-1.1 | openSUSE-SU-2025:15254-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | splunk-otel-collector | 0.138.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 1.14.8, < 1.20.0 | 1.20.0 | GHSA-fhc2-8qx8-6vj7 |
Advisories 3
- openSUSE-SU-2025:15405-1 govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15254-1 openbao-2.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1400 Hashicorp Vault: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 25, 2025