HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.
Affected versions
0 → fixed in 1.13.101.14.0 → fixed in 1.14.61.15.0 → fixed in 1.15.2
Details
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault
The fix
No fix commit could be resolved for this advisory (it may reference an issue tracker or a non-GitHub patch). See the references below.
References
- ADVISORYhttps://github.com/advisories/GHSA-4qhc-v8r6-8vwm
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-5954
- WEBhttps://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926
- WEBhttps://security.netapp.com/advisory/ntap-20231227-0001