Threats affecting pkg:maven/io.github.jopenlibs/vault-java-driver

CVE-2026-112072 is a vulnerability in the vault-java-driver library used to interact with HashiCorp Vault. The issue arises from a minimal-json parser with no limit on nesting depth, allowing deeply nested JSON values to cause a StackOverflowError. This error escapes typical exception handling and crashes the reading thread. The vulnerability affects versions 5.2.0 through 6.2.3 and requires Vault versions 1.19.x or earlier, as Vault 1.20 and later reject deeply nested values beyond 298 levels. The issue is fixed in vault-java-driver version 7.0.0.

The vault-java-driver library versions 5.2.0 through 6.2.3 have a vulnerability where TLS certificate and hostname verification can be silently disabled in certain conditions, despite the caller requesting verification. This results in the driver installing a trust-all SSLContext, allowing an attacker on the network path to intercept and read Vault tokens and secrets, and potentially forge responses. The issue is fixed in version 7.0.0.