LOW3.1

GHSA-fhc2-8qx8-6vj7

Vault Community Edition rekey and recovery key operations can cause denial of service

Quick fix

GHSA-fhc2-8qx8-6vj7 — github.com/hashicorp/vault: upgrade to the fixed version with the command below.

go get github.com/hashicorp/vault@v1.20.0

Details

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hashicorp/vault

Introduced in: 1.14.8Fixed in: 1.20.0

Fixgo get github.com/hashicorp/vault@v1.20.0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4656[ADVISORY]
https://github.com/hashicorp/vault/pull/30794[WEB]
https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570[WEB]
https://github.com/hashicorp/vault[PACKAGE]