CVE-2025-4656

Name: CVE-2025-4656
Creator: NVD / NIST
Published: 2025-06-25T17:15:38.44+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 3.1/10EPSS 0.21%

Last modified Jun 17, 2026

CVE-2025-4656 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Metrics

CVSS 3.1

3.1/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

EPSS Probability

0.21%

11.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-1088

Affected Software

Vendor	Product	Versions
Hashicorp	Vault	>= 1.14.8, < 1.16.22
Hashicorp	Vault	>= 1.14.8, < 1.20.0
Hashicorp	Vault	>= 1.17.0, < 1.17.17
Hashicorp	Vault	>= 1.18.0, < 1.18.11
Hashicorp	Vault	>= 1.19.0, < 1.19.6

References

https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570Vendor Advisory

Timeline

Published: Jun 25, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-4656?

How severe is CVE-2025-4656?

CVE-2025-4656 has a CVSS score of 3.1/10 (LOW severity). The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.

How do I fix CVE-2025-4656?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-4656?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST