OpenBao CVE-2025-59043

No special conditions beyond network reachability - remote unauthenticated exploitation is possible against default configurations because request JSON is parsed into memory before authentication, and the advisory notes the amplification lets an attacker bypass the max_request_size limit meant to prevent this. Limiting factors: the attacker must be able to reach an exposed OpenBao HTTP/API listener (typically network-segmented in production); impact is confined to availability (OOM crash or audit-subsystem CPU exhaustion) with no data exposure; affected versions are <=2.4.0, and operators can mitigate by setting the new max_request_json_memory and max_request_json_strings (max_request_json_complexity) parameters introduced in the fix.

Signals are internally consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a remote, low-complexity, unauthenticated vector, corroborated by the GHSA advisory stating the request body is parsed into a map[string]interface{} before authentication - so the pre-auth attack surface is real. However, impact is availability-only (C:N/I:N/A:H), consistent with CWE-400 resource exhaustion (OOM crash / audit-subsystem CPU exhaustion), with no confidentiality or integrity exposure despite OpenBao being a secrets manager. The EPSS score is low (0.16%, 37th percentile) and the vulnerability is NOT in CISA KEV, with no public exploit identified - so this is not evidence of widespread active exploitation. The amplification factor (~35x reported in the advisory) makes DoS cheaper for an attacker, which raises practical concern above a typical DoS. Net: a legitimate patch-worthy issue for exposed OpenBao listeners, but a DoS-only, non-KEV, low-EPSS item rather than a drop-everything emergency. One cross-source conflict to verify: the input CVE is CVE-2025-59043 (Alpine tracking) yet the fix changelog and advisory reference CVE-2025-6203 / HCSEC-2025-24 as the upstream identifier - verify identifier mapping with the vendor.

An unauthenticated attacker with network reach to the OpenBao API listener sends a specially crafted JSON request body (a 'JSON bomb' tuned to maximize deserialized-vs-serialized memory, ~35x) to a pre-authentication endpoint. OpenBao decodes it into an in-memory map before any auth check, exhausting memory and crashing the process (OOM), or saturating CPU in the audit subsystem with large string counts. No public exploit code is identified at time of analysis, but the advisory describes the technique in enough detail to reproduce.