Vulnerabilidades de HashiCorp

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de HashiCorp: 55 registro(s), com severidade, exploração e correções.

Consul 15 Consul Enterprise 15 Vault Enterprise 14 Vault 12 Tooling 11 Shared library 5 Nomad 5 Nomad Enterprise 5 Terraform Enterprise 2 Terraform Provider 1 Terraform 1 Boundary 1 Boundary Enterprise 1 Go-slug 1 Packer 1

Somente exploradas (KEV) →

CVE-2025-13357 Crítica · 9.8 CWE-1188 21/11/2025

Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method

Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.

CVE-2025-11375 Média · 6.5 CWE-770 28/10/2025

Consul's event endpoint is vulnerable to denial of service

Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

CVE-2025-11374 Média · 6.5 CWE-770 28/10/2025

Consul's KV endpoint is vulnerable to denial of service

Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

CVE-2025-12044 Alta · 7.5 CWE-770 23/10/2025

Vault Vulnerable to Denial of Service Due to Rate Limit Regression

Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.

CVE-2025-11621 Alta · 8.1 CWE-288 23/10/2025

Vault AWS auth method bypass due to AWS client cache

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27