Java client vulnerability in HashiCorp Vault by jopenlibs
CVE-2026-112072

6.5MEDIUM

Key Information:

Vendor

Jopenlibs

Status
Vault-java-driver
Vendor
CVE Published:
5 November 2026

What is CVE-2026-112072?

The vault-java-driver, a Java client for HashiCorp Vault, is vulnerable to issues arising from parsing JSON responses that may be deeply nested. When attempting to read a deeply nested value, a StackOverflowError occurs, which escapes the exception handling and disrupts the reading thread. This vulnerability can be exploited by storing such deeply nested values in a KV v2 path using a Vault token with write access but without read access. It is specifically a concern in Vault versions 1.19.x and earlier, as versions 1.20 and later impose a limit on nesting levels by rejecting values that exceed 298 levels. The vulnerability affects the vault-java-driver versions 5.2.0 through 6.2.3, and it has been resolved in version 7.0.0.

Affected Version(s)

vault-java-driver 5.2.0 < 7.0.0

References

https://github.com/jopenlibs/vault-java-driver/pull/81
patch
https://repo.maven.apache.org/maven2/io/github/jopenlibs/...
patch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuval Saggie and Mor Wienberger (powered by Echo Frontier)
.