OpenBao vulnerable to denial of service via malicious JSON request processing (CVE-2025-59043)

OpenBao, an open source identity-based secrets management system, has a denial of service vulnerability (CVE-2025-59043) in versions prior to 2.4.1. The vulnerability is due to JSON objects that, after decoding, can use up to approximately 35 times more memory than their serialized size, similar to a zip bomb. This allows attackers to circumvent the max_request_size configuration designed to limit request sizes. Because the JSON request body is parsed into a map early in the request handling chain before authentication, unauthenticated attackers can send crafted JSON payloads that cause out-of-memory crashes. Additionally, the audit subsystem can consume excessive CPU resources when handling requests with large numbers of strings. The vulnerability is fixed in version 2.4.1.

An unauthenticated attacker can cause OpenBao servers running versions prior to 2.4.1 to crash by sending specially crafted JSON requests that consume excessive memory, leading to denial of service. The attack bypasses configured request size limits and can also cause high CPU usage in the audit subsystem, potentially degrading service availability.

Upgrade OpenBao to version 2.4.1 or later, where this vulnerability is fixed. The patch is available at https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c. No other mitigation is required once the system is updated.