HashiCorp Vault Denial-of-Service Vulnerability via Unauthenticated Root Token Operations

A denial-of-service vulnerability has been identified in HashiCorp Vault. An unauthenticated attacker can disrupt operations by repeatedly initiating or canceling root token generation or rekey processes. This activity occupies the sole available operation slot, preventing legitimate users from completing these tasks. The issue affects Vault versions prior to 2.0.0 and is present in both the Community and Enterprise Editions.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where legitimate operations related to root token management are interrupted and无法完成.

Remediation

Users can upgrade to Vault Community Edition 2.0.0 or Vault Enterprise 2.0.0 to address this vulnerability.