CVE-2023-5954

    Dashboard / Vulnerabilities / CVE-2023-5954

    CVE-2023-5954

    Published: 9 Nov 2023Last Modified: 12 Aug 2026

    Summary: Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

    Details: HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

    References: https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5954.json, https://nvd.nist.gov/vuln/detail/CVE-2023-5954, https://security.netapp.com/advisory/ntap-20231227-0001/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 895eb72029d83fcefb8a079e056e7024d8dc6020
    Fixed -39680359a1c5d78d05679ac94fa4f0944d442581

    Affected versions

    v1.13.9
    v1.13.8
    v1.13.7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-5954 | CVE-DB