Memory Consumption Vulnerability in OpenBao Secrets Management System

CVE-2025-59043

What is CVE-2025-59043?

In OpenBao versions before 2.4.1, a vulnerability exists that allows attackers to exploit JSON object processing, leading to excessive memory usage. By crafting specific JSON payloads, an attacker can force the system to allocate far more memory than anticipated, resembling a 'zip bomb' effect, with an observed factor of up to 35. This results in potential denial of service conditions by exceeding the max_request_size limit, as the payload is parsed early in the request handling process, before any authentication checks. Consequently, this enables unauthenticated attackers to cause out-of-memory crashes. Additionally, crafting large JSON requests can also lead to high CPU consumption, further degrading system performance. The issue has been resolved in version 2.4.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References