CVE-2025-4656
Low
Description
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
SeverityLow
CVSS3.1
Exploit probability—
Product
Hashicorp Vault
PublishedJun 25, 2025
First seenJun 25, 2025
Weakness typeCWE-1088CWE-1088
How to fix
Update
- hashicorp vault1.16.22, 1.20.0, 1.17.17, 1.18.11, 1.19.6 or later
- github.com/hashicorp/vault1.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hashicorp vault | 1.14.8 ≤ v < 1.16.22, 1.14.8 ≤ v < 1.20.0, 1.17.0 ≤ v < 1.17.17, 1.18.0 ≤ v < 1.18.11, 1.19.0 ≤ v < 1.19.6 | 1.16.22, 1.20.0, 1.17.17, 1.18.11, 1.19.6 |
| github.com/hashicorp/vaultGo | 1.14.8 ≤ v < 1.20.0 | 1.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.