Vulnerability DatabaseCVE-2024-2660
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-2660
Published:April 04, 2024
Updated:October 15, 2026
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
Affected Packages
github.com/hashicorp/vault (GO):
Affected version(s) >=v1.2.2 <v1.16.0
Fix Suggestion:
Update to version v1.16.0
Related Resources (7)
https://security.netapp.com/advisory/ntap-20240524-0007/
https://github.com/hashicorp/vault
https://security.netapp.com/advisory/ntap-20240524-0007
https://nvd.nist.gov/vuln/detail/CVE-2024-2660
https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2660.json
https://github.com/advisories/GHSA-j2rp-gmqv-frhv
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.4
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Not Failing Securely ('Failing Open')
CWE-636
Improper Check or Handling of Exceptional Conditions
CWE-703
EPSS
Base Score:
0.30