Medium severity · published Jul 28, 2023
CVE-2023-3774
Vault Enterprise Namespace Creation May Lead to Denial of Service
4.9
CVSS
0.7%
EPSS
No
On KEV
Description
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Vault Enterprise · HashiCorp
1.14.0; 1.13.4; 1.12.8 · source: vendor
VA
Vault · Hashicorp
1.12.8; 1.13.4; 1.14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3774
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3774
Vendor Advisory
https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617
More from Vault Enterprise
9.8
CVE-2024-2048
Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates
9.1
CVE-2025-6000
Arbitrary Remote Code Execution via Plugin Catalog Abuse
8.8
CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header
8.8
CVE-2025-3879
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
8.8
CVE-2024-7594
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default