OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use significantly more memory than their serialized version. It is possible to craft a JSON payload to maximize the factor between serialized memory usage and deserialized memory usage, similar to a zip bomb, with factors reaching approximately 35. This can be used to circumvent the max_request_size configuration parameter which is intended to protect against denial of service attacks. The request body is parsed into a map very early in the request handling chain before authentication, which means an unauthenticated attacker can send a specifically crafted JSON object and cause an out-of-memory crash. Additionally, for requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. The vulnerability is fixed in version 2.4.1.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c Patch
- https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · openbaoNVD modified 2026-10-19 16:10
Affected (CPE criteria) 1
cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*
References 4
- https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 Product
- https://github.com/openbao/openbao/commit/d418f238bc99adc72c73109faf574cc2b672880c Patch
- https://github.com/openbao/openbao/pull/1756 Issue Tracking
- https://github.com/openbao/openbao/security/advisories/GHSA-g46h-2rq9-gw5m Vendor Advisory