CVE-2024-12289: Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Vulnerability summary
CVE-2024-12289 is a medium (CVSS 5.9) Improper Cleanup on Thrown Exception vulnerability in hashicorp boundary. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 33.7% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 12-12-2024PublishedVulnerability first disclosed.
- 13-12-2024Last modifiedVulnerability information updated.
Description
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.39% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Hashicorp2 products
- boundary≥ 0.8.0, < 0.18.2 | ≥ 0.8.0, < 0.16.4 | ≥ 0.17.0, < 0.17.3 | ≥ 0.18.0, < 0.18.2
- boundary enterprise≥ 0.8.0, < 0.18.2
Github.com/hashicorp1 product
- boundary< 0.18.2
2 vendors · 3 products
