Threats tagged 'ghsa-g3p9-q9ch-26gc'

The vault-java-driver, a Java client for HashiCorp Vault, uses a minimal-json parser without a nesting depth limit. This can cause a StackOverflowError when parsing deeply nested JSON values, which escapes standard exception handling and terminates the reading thread. An attacker with write-only Vault token permissions on a KV v2 path can store such deeply nested values, causing subsequent reads through the driver to fail. This vulnerability affects versions 5.2.0 through 6.2.3 and requires Vault 1.19.x or earlier, as later Vault versions reject deeply nested values. The issue is fixed in vault-java-driver version 7.0.0.