{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-23T13:20:35.447","vulnerabilities":[{"cve":{"id":"CVE-2025-59043","sourceIdentifier":"security-advisories@github.com","published":"2025-10-17T16:15:38.763","lastModified":"2025-10-24T17:13:10.880","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.1","matchCriteriaId":"542C558D-BFC0-4CC6-B683-74E4DFB31A30"}]}]}],"references":[{"url":"https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/openbao/openbao/pull/1756","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}