-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) The raft bootstrap challenge handler (handleRaftBootstrapChallengeWrite) lacked rate limiting and used non-expiring storage, allowing attackers to flood the system with challenges. 2) The sync.Map implementation in Core.pendingRaftPeers had no memory limits. The fix introduced an LRU cache with size constraints (RaftInitialChallengeLimit) and rate limiting via golang.org/x/time/rate, directly addressing these memory exhaustion vectors. The commit diff shows the transition from sync.Map to LRU and the addition of challenge limits in these components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/vault | go | >= 1.2.0, < 1.18.1 | 1.18.1 |