CVE-2025-4656

low-risk
Published 2025-06-25

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.1/10 Low
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Hashicorp

References (1)

Vendor Advisory https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-c...
18
/ 100
low-risk
Severity 11/34 · Low
Exploitability 0/34 · Minimal
Exposure 7/34 · Low