Homepage

Resource Exhaustion Affecting openbao package, versions <2.4.1-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.65% (47th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE323-OPENBAO-14182472
  • published4 Dec 2025
  • disclosed17 Oct 2025
Report a new vulnerability Found a mistake?

Introduced: 17 Oct 2025

CVE-2025-59043  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade Alpine:3.23 openbao to version 2.4.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openbao package and not the openbao package as distributed by Alpine. See How to fix? for Alpine:3.23 relevant fixed versions and status.

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.