CVE-2026-112072 · Package
NO FIX YET · SEE WHAT TO DO
The vault-java-driver Java client for HashiCorp Vault parses responses with a vendored JSON parser that has no nesting depth limit, so a deeply nested value raises a StackOverflowError that escapes normal exception handling and kills the thread. A token that can write but not read a KV v2 path can store such a value, so later reads of that path through the driver fail.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the vault-java-driver library to read secrets from HashiCorp Vault, in versions 5.2.0 through 6.2.3. The attack needs a Vault token that can write to a KV v2 path but cannot read it, and a Vault server at 1.19.x or earlier, since 1.20 and later reject deeply nested values. Teams on Vault 1.20 or later, or who do not let untrusted writers store values in paths their services read, are less exposed.
Not affected if no-untrusted-writers, vault-1.20-or-later
Who cares hashicorp-vault, java, kv-v2, vault
io.github.jopenlibs:vault-java-driver in your build file (for example pom.xml or build.gradle).1.19.x or earlier, since the attack needs those versions.io.github.jopenlibs:vault-java-driver upgrade to 7.0.0vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vault token that can write but not read a KV v2 path can store such a value there, so every later read of that path through the driver fails. This requires Vault 1.19.x or earlier, because 1.20 and later reject values nested deeper than 298 levels. This issue affects io.github.jopenlibs:vault-java-driver 5.2.0 through 6.2.3 and is fixed in 7.0.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.