CVE-2025-59043: Github.com/openbao/openbao Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g46h-2rq9-gw5m",
  "modified" : "2025-10-17T19:07:55Z",
  "published" : "2025-10-17T17:08:11Z",
  "aliases" : [ "CVE-2025-59043" ],
  "summary" : "OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests",
  "details" : "### Summary\n\nJSON objects after decoding might use more memory than their serialized version. It is possible to tune a JSON to maximize the factor between serialized memory usage and deserialized memory usage (similar to a zip bomb). While reproducing the issue, we could reach a factor of about 35. This can be used to circumvent the [`max_request_size` (https://openbao.org/docs/configuration/listener/tcp/) configuration parameter, which is meant to protect against Denial of Service attacks, and also makes Denial of Service attacks easier in general, as the attacker needs much less resources.\n\n### Details\n\nThe request body is parsed into a `map[string]interface{}` https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 very early in the request handling chain (before authentication), which means an attacker can send a specifically crafted JSON object and cause an OOM crash. Additionally, for simpler requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. \n\nTo remediate, set `max_request_json_memory` and `max_request_json_strings`.\n\n### Impact\n\n- Unauthenticated Denial of Service\n\n### Resources\n\nThis issue was disclosed directly to HashiCorp and is the OpenBao equivalent of the following tickets:\n\n- https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393\n- https://nvd.nist.gov/vuln/detail/CVE-2025-6203\n\nHashiCorp attributes the problem to the audit subsystem. For OpenBao, it was noted the problem was additionally in the requests handling logic.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/openbao/openbao"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.4.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59043"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-6203"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/pull/1756"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c"
  }, {
    "type" : "WEB",
    "url" : "https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openbao/openbao"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-10-17T17:08:11Z",
    "nvd_published_at" : "2025-10-17T16:15:38Z"
  }
}