Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2024-8185

Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself.

This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.

  • Published: Oct 31, 2024
  • Updated: Nov 14, 2025
  • CVE: CVE-2024-8185
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWEs:

Software From Fixed in
hashicorp / vault 1.2.0 1.18.1
hashicorp / vault 1.17.0 1.17.8
hashicorp / vault 1.2.0 1.16.12
hashicorp / vault 1.18.0 1.18.0.x
openbao / openbao - 2.0.3