HashiCorp Boundary versions prior to 0.19.5, 0.20.3, and 0.21.3 are vulnerable to a denial-of-service condition (CWE-770) during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener can initiate TLS connections and delay or withhold the client certificate, causing the worker's connection handling process to block. This resource exhaustion prevents legitimate worker connections from being processed, impacting service availability. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. Official fixes are available in the specified patched versions.

Successful exploitation results in denial of service by blocking worker connections in HashiCorp Boundary, preventing legitimate worker nodes from connecting or routing traffic. There is no impact on confidentiality or integrity, but availability is significantly affected. No known exploits in the wild have been reported.

This vulnerability is fixed in HashiCorp Boundary versions 0.21.3, 0.20.3, and 0.19.5. Users should upgrade to one of these fixed versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory embedded in the description.