CVE-2024-8185

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Not Failing Securely ('Failing Open') pada hashicorp vault, openbao. Skor CVSS 3.1 7.5 (High) menurut hashicorp.com.

Deskripsi (NVD)

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.

Rincian

Terbit di NVD

31 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber hashicorp.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-636: Not Failing Securely ('Failing Open')

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.hashicorp.com/t/hcsec-2024-26-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-... advisory vendor