CVE-2024-8185 Vault Vulnerable to Denial of Service When Processing Raft Join Requests
Attackers can cause denial of service in HashiCorp Vault by exhausting memory via Raft join requests, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-8185?
CVE-2024-8185 is a high-severity denial of service vulnerability in Hashicorp Vault, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself.
This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.
Weakness: CWE-636
Which versions are affected by CVE-2024-8185?
7 open source packages ship an affected version, including github.com/hashicorp/vault, openbao and vault. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/vault Go | From 1.2.0 | 1.18.1 |
github.com/hashicorp/vault Go | From 1.2.0 | 1.18.1 |
github.com/hashicorp/vault Go | From 1.2.0 | 1.18.1 |
openbao Bitnami | All versions | 2.0.3 |
vault Bitnami | From 1.2.0 | 1.18.1 |
github.com/openbao/openbao Go | All versions | 2.0.3 |
1 more packages
github.com/openbao/openbao Go | All versions | 2.0.3 |
Products include Hashicorp Vault, Openbao Openbao.
How do I fix CVE-2024-8185?
Upgrade github.com/hashicorp/vault to 1.18.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-8185 being exploited?
There is no known exploitation of CVE-2024-8185 in the wild and no public exploit code.
Other vulnerabilities in Hashicorp Vault
Sources
Also known as BIT-openbao-2024-8185, BIT-vault-2024-8185, GHSA-g233-2p4r-3q7v, GO-2024-3246.