Homepage

Resource Exhaustion Affecting openbao package, versions <2.4.1-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.12% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ALPINE322-OPENBAO-13704018
  • published24 Oct 2025
  • disclosed17 Oct 2025
Report a new vulnerability Found a mistake?

Introduced: 17 Oct 2025

NewCVE-2025-59043  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade Alpine:3.22 openbao to version 2.4.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openbao package and not the openbao package as distributed by Alpine. See How to fix? for Alpine:3.22 relevant fixed versions and status.

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.