Boundary workers are vulnerable to a denial‑of‑service condition that occurs during the TLS handshake when a client certificate is delayed or withheld. The flaw is a resource exhaustion vulnerability (CWE‑770) that can block the worker’s connection handling, preventing any legitimate worker connections from being accepted or routed.

The affected products are HashiCorp Boundary Community Edition and HashiCorp Boundary Enterprise. Versions up to Boundary 0.21.2 (Community) and up to Boundary 0.20.2 (Enterprise) contain the issue; the vulnerability is addressed in Boundary 0.21.3, 0.20.3 and 0.19.5.

The CVSS score is 7.5, indicating a high severity, and the EPSS score is not available, making the exploitation probability unclear. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a network connection to the worker authentication listener. An attacker who can reach that listener may open a TLS session and intentionally delay or withhold the client certificate, causing the worker to block on the handshake and effectively suspend legitimate connections.