io.github.jopenlibs/vault-java-driver vulnerabilities

Latest io.github.jopenlibs/vault-java-driver CVEs

Newest publication first

1. CVE-2026-112072 vault-java-driver: stored deeply nested JSON kills every thread that reads it

   Published 2026-11-05

   Medium·CVSS 6.5

   vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch (Exception) handlers and kills the reading thread. A Vau...

2. CVE-2026-109408 vault-java-driver: SslConfig silently disables requested TLS verification

   Published 2026-11-05

   High·CVSS 7.4

   vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in three states where the caller asked for verification: an SslConfig passed to VaultConfig without calling build(), an SslConfig restored by Java deserialization, an...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.