CVE-2023-6337: Memory exhaustion in HashiCorp Vault

The vulnerability stems from unconstrained memory allocation when processing HTTP requests for rate limit checks. The GitHub PR #24354 shows the fix involved adding size limits using io.LimitReader when reading request bodies. This indicates the vulnerable code path was in request handling functions that process HTTP bodies without size constraints prior to applying rate limits. The handleRequest function (or equivalent middleware) would be responsible for this pre-rate-limit processing described in the advisory. The high confidence comes from: 1) The vulnerability directly relates to unbounded request body processing 2) The fix explicitly adds size limiting 3) The advisory specifies the vulnerable code exists in the rate limit check path before quotas are applied.