---
id: CVE-2025-6203
title: >-
  A malicious user may submit a specially-crafted complex payload that otherwise
  meets the default request size limit which results in excessive memory and CPU
  consumption of Vault
summary: >-
  A malicious user may submit a specially-crafted complex payload that otherwise
  meets the default request size limit which results in excessive memory and CPU
  consumption of Vault. This may lead to a timeout in Vault’s auditing
  subroutine…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: hashicorp
product: vault
affected:
  - 'vault >= 1.15.0, < 1.16.27'
  - 'vault >= 1.15.0, < 1.21.0'
  - 'vault >= 1.18.0, < 1.18.15'
  - 'vault >= 1.19.0, < 1.19.11'
  - 'vault >= 1.20.0, < 1.20.5'
patched:
  - vault 1.20.5
published: '2025-08-28'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T00:10:00.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6203'
references:
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393
    label: security@hashicorp.com
tags:
  - nvd
epss: 0.00699
epssPercentile: 0.51117
ingestedAt: '2026-09-26T00:22:39.893Z'
---

## Overview

A malicious user may submit a specially-crafted complex payload that otherwise meets the default request size limit which results in excessive memory and CPU consumption of Vault. This may lead to a timeout in Vault’s auditing subroutine, potentially resulting in the Vault server to become unresponsive. This vulnerability, CVE-2025-6203, is fixed in Vault Community Edition 1.20.3 and Vault Enterprise 1.20.3, 1.19.9, 1.18.14, and 1.16.25.

## Affected

- `vault >= 1.15.0, < 1.16.27`
- `vault >= 1.15.0, < 1.21.0`
- `vault >= 1.18.0, < 1.18.15`
- `vault >= 1.19.0, < 1.19.11`
- `vault >= 1.20.0, < 1.20.5`

## Remediation

Upgrade past the affected range:

- `vault 1.20.5`