TI-2025-36685 Aliases CVE-2025-59043 GHSA-g46h-2rq9-gw5m

OpenBao vulnerable to denial of service via malicious JSON request processing

MEDIUM 40CWE-400Published 2025-10-17 · Updated 2025-10-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00688 52nd percentileScored 2026-11-07

Fix Fixed openbao (openbao): 2.4.1github.com/openbao/openbao (Go): 2.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
openbao	openbao	before 2.4.1	2.4.1	Patch available	CNA
—	github.com/openbao/openbao (Go)	before 2.4.1	2.4.1	Patch available	GHSA-g46h-2rq9-gw5m

openbao Vendoropenbao Affected before 2.4.1 Fixed in 2.4.1 Patch available CNA
github.com/openbao/openbao (Go) Vendor— Affected before 2.4.1 Fixed in 2.4.1 Patch available GHSA-g46h-2rq9-gw5m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openbao:openbao::::::::	before 2.4.1	Vulnerable	openbao

cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·openbao

Remediation

Fix · CNA openbao (openbao) Fixed in 2.4.1
Fix · GHSA-g46h-2rq9-gw5m github.com/openbao/openbao (Go) Fixed in 2.4.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-59043
2026-10-03 Alias added: GHSA-g46h-2rq9-gw5m

References

Patch 1

https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c

Advisory 3

Other 4

TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
TI-2026-28381 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) CVSS 3.1MEDIUM 6.5
TI-2026-26136 OpenBao lacks user confirmation for OIDC direct callback mode CVSS 3.1CRITICAL 9.6
TI-2026-26137 OpenBao has Reflected XSS in its OIDC authentication error message CVSS 4.0CRITICAL 9.4
TI-2025-34701 OpenBao: Privileged Operator May Execute Code on the Underlying Host CVSS 3.1CRITICAL 9.1
TI-2024-07039 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default CVSS 3.1HIGH 8.8

See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences