CVE-2025-12044: vault from 1.16.25 (inclusive), before 1.16.27 (exclusive), from 1.18.14 (inclusive), through 1.18.15 (inclusive)…

Affected technology

vault · from 1.16.25 (inclusive), before 1.16.27 (exclusive)
hashicorp

vault · from 1.18.14 (inclusive), through 1.18.15 (inclusive)
hashicorp

vault · from 1.19.9 (inclusive), through 1.19.11 (inclusive)
hashicorp

vault · from 1.20.3 (inclusive), before 1.20.5 (exclusive)
hashicorp

vault · from 1.20.3 (inclusive), before 1.21.0 (exclusive)
hashicorp

Vault · 1.20.3 to before 1.21.0
HashiCorp

Vault Enterprise · 1.20.3 to before 1.21.0; status changes: 1.20.5 — unaffected, 1.19.9 to before 1.19.11; status changes: 1.19.11 — unaffected, 1.18.14 to before 1.18.15; status changes: 1.18.15 — affected, 1.16.25 to before 1.16.27; status changes: 1.16.27 — unaffected
HashiCorp

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.