CVE-2025-4656

Description

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

CVSS v3.1 Score

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-1088 CWE-1088

Affected Products

Vendor	Product	Versions
hashicorp	vault	1.14.8 — 1.16.22
hashicorp	vault	1.14.8 — 1.20.0
hashicorp	vault	1.17.0 — 1.17.17
hashicorp	vault	1.18.0 — 1.18.11
hashicorp	vault	1.19.0 — 1.19.6

References

Advisories & Patches

https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570

Frequently Asked Questions

What is CVE-2025-4656? +

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22. It has a CVSS v3.1 base score of 3.1 (LOW).

How severe is CVE-2025-4656? +

CVE-2025-4656 has a CVSS v3.1 score of 3.1 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2025-4656? +

CVE-2025-4656 affects products from hashicorp, specifically: vault. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-4656? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8061 7.5

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the …

CVE-2024-8062 7.5

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a …

CVE-2024-12777 5.9

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking …

CVE-2024-3817 9.8

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect …

CVE-2025-6000 9.1

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying …

CVE-2024-6257 8.4

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to …