HashiCorp Vault CVE-2025-12044

Exploitation requires network reachability to Vault's HTTP API and targets the JSON request-processing path, which executes before rate limiting is applied - this is the specific regression. No authentication, user interaction, or non-default feature flag is required (AV:N/AC:L/PR:N/UI:N), so default Vault deployments reachable over the network are exposed. The primary limiting factor is network exposure: Vault instances restricted behind private networks, mutual-TLS, or upstream API gateways/WAFs that enforce their own rate limiting reduce the attack surface. Only versions prior to the fixes (Vault Community 1.21.0; Vault Enterprise 1.16.27, 1.19.11, 1.20.5, 1.21.0) are affected, and environments that only applied the earlier HCSEC-2025-24 fix remain vulnerable due to the regression.

Signals are broadly consistent and point to a moderate, availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, but impact is confined to availability (C:N/I:N/A:H) - there is no confidentiality or integrity exposure, which matches the CWE-770 (uncontrolled resource consumption) DoS classification. The 7.5 score is driven entirely by the A:H availability hit, not by code execution or data compromise. EPSS is low at 0.53% (44th percentile), indicating no statistical evidence of imminent widespread exploitation, and the CVE is NOT in CISA KEV with no public exploit identified at time of analysis - so the 'network/unauthenticated' ease is offset by the absence of active-exploitation signals. No SSVC decision data was provided in the input. Net: this is a credible patch-worthy availability bug for Vault operators (Vault is a high-value secrets-management chokepoint, so an outage has outsized operational impact), but it is not an emergency relative to code-execution or actively-exploited CVEs. Note the regression context - this reopens HCSEC-2025-24 - so environments patched only against the earlier issue remain exposed.

A remote, unauthenticated attacker sends specially crafted or complex JSON payloads to an internet-exposed or network-reachable Vault API endpoint. Because the regression allows JSON to be processed before rate limits are applied, the request consumes excessive resources, and a flood of such payloads exhausts CPU/memory and renders Vault unavailable to legitimate clients. No public exploit code is identified at time of analysis, but the low attack complexity makes reliable weaponization straightforward.