Vault Java Driver parses Vault's JSON responses with a vendored minimal‑json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError that escapes catch (Exception) handlers and kills the reading thread, which leads to a denial of service in the application using the driver. This flaw is exploitable by a Vault token that can write but not read a KV v2 path, allowing the attacker to store a deeply nested value that persists and causes the driver to crash on every subsequent read of that path.

Systems using io.github.jopenlibs:vault-java-driver versions 5.2.0 through 6.2.3, together with HashiCorp Vault 1.19.x or earlier, are affected. The driver is published by jopenlibs and is intended for Java applications that communicate with Vault. Any application that grants write access to a KV v2 path can exploit the vulnerability.

The CVSS score of 6.5 reflects a moderate severity. The exploit requires an authenticated Vault token with write rights to a KV v2 path; no special privileges or network access are needed. Because a single malicious write can cause the driver to terminate all reading threads, the vulnerability can be used to disrupt service availability, but it does not facilitate privilege escalation or data exfiltration. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.