CVE-2024-12289

Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

State: Published
Severity: 5.9 Medium
Published: Dec 12, 2024
Updated: Dec 13, 2024
Reserved: Dec 5, 2024

Description

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.

This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H	HashiCorp

Weaknesses

CWE-460 Improper Cleanup on Thrown Exception

Affected Products

Product	Versions
BoundaryHashiCorp	0.8.0 to before 0.18.2Affectedfrom 0.16.4Not affectedfrom 0.17.3Not affected
Boundary EnterpriseHashiCorp	0.8.0 to before 0.18.2Affectedfrom 0.16.4Not affectedfrom 0.17.3Not affected

References

https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.