CVE-2025-12044: Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON

The vulnerability, CVE-2025-12044, is a denial of service in Hashicorp Vault caused by a regression in a security feature designed to prevent DoS from complex JSON payloads. The analysis of the provided patches reveals that the vulnerability was introduced in commit eedc2b7426f30e57e306229ce697ce81e203ab89 and fixed in b19e74c29a33ed2a99fc01626104db1a49345df3.

The root cause is the inefficient implementation of the VerifyMaxDepthStreaming function in the sdk/helper/jsonutil package. This function, intended to validate incoming JSON, used the standard json.Decoder, which performs poorly on certain crafted inputs (e.g., strings with many escape characters), leading to high CPU and memory usage and ultimately a denial of service. The vulnerability is that the security check itself is the attack vector.

The exploitation of this vulnerability would involve sending a specially crafted JSON payload to a Vault HTTP endpoint. The request would be processed by the wrapMaxRequestSizeHandler middleware, which in turn calls jsonLimitsValidation. This function then invokes the vulnerable VerifyMaxDepthStreaming function, triggering the excessive resource consumption.

The identified vulnerable functions are:

1. github.com/hashicorp/vault/http.wrapMaxRequestSizeHandler: The HTTP middleware that initiates the vulnerable validation process.
2. github.com/hashicorp/vault/http.jsonLimitsValidation: The helper function that reads the request body and calls the parser.
3. github.com/hashicorp/vault/sdk/helper/jsonutil.VerifyMaxDepthStreaming: The core function containing the flawed, resource-intensive JSON parsing logic.

A runtime profile during an exploit would show significant time spent in these functions, particularly VerifyMaxDepthStreaming.