CVE-2025-4656 Vault Vulnerable to Recovery Key Cancellation Denial of Service

What is CVE-2025-4656?

CVE-2025-4656 is a low-severity denial of service vulnerability in Hashicorp Vault, published on 25 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Weakness: CWE-1088

Which versions are affected by CVE-2025-4656?

4 open source packages ship an affected version, including github.com/hashicorp/vault and vault. It affects 1 product.

Products include Hashicorp Vault.

How do I fix CVE-2025-4656?

Upgrade github.com/hashicorp/vault to 1.20.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-4656 being exploited?

There is no known exploitation of CVE-2025-4656 in the wild and no public exploit code.

Other vulnerabilities in Hashicorp Vault

• CVE-2020-35192 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-12757 Improper Input Validation in HashiCorp Vault Critical 9.8
• CVE-2025-6000 Arbitrary Remote Code Execution via Plugin Catalog Abuse Critical 9.1
• CVE-2022-40186 HashiCorp Vault vulnerable to incorrect metadata access Critical 9.1
• CVE-2022-36129 Missing authorization in n/a Critical 9.1

All Hashicorp Vault vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-vault-2025-4656, CLEANSTART-2026-OX83822, GHSA-fhc2-8qx8-6vj7, GO-2025-3788, MINI-7c2c-9m94-8x9j.