Vulnerability Description
OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openbao | Openbao | < 2.4.1 |
Related Weaknesses (CWE)
References
- https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9Product
- https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b67288Patch
- https://github.com/openbao/openbao/pull/1756Issue Tracking
- https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5mVendor Advisory
FAQ
What is CVE-2025-59043?
CVE-2025-59043 is a vulnerability with a CVSS score of 7.5 (HIGH). OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It ...
How severe is CVE-2025-59043?
CVE-2025-59043 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-59043?
Check the references section above for vendor advisories and patch information. Affected products include: Openbao Openbao.