OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1,
    JSON objects after decoding may use significantly more memory than their serialized version. It is
    possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized
    memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to
    circumvent the max_request_size configuration parameter which is intended to protect against denial of
    service attacks. The request body is parsed into a map very early in the request handling chain before
    authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and
    cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit
    subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.
    (CVE-2025-59043)

ID	Name	Product	Family	Severity
435757	Alpine: multiple openbao packages: security update to 2.4.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
435757	Alpine: multiple openbao packages: security update to 2.4.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
435672	SCA: security update for github.com/openbao/openbao (GHSA-g46h-2rq9-gw5m)	Tenable Cloud Security	SCA Checks	high
435672	SCA: security update for github.com/openbao/openbao (GHSA-g46h-2rq9-gw5m)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-59043

high

Tenable Plugins

high

high

high

high