{"action":"Upgrade github.com/hashicorp/vault to 1.19.3 or later.","affected":[{"fixed":"1.19.3","introduced":"0.3.0"}],"component":"github.com/hashicorp/vault","cve_ids":["CVE-2025-4166"],"ecosystem":"Go","epss":0.00457,"exploited":false,"fixed_versions":["1.19.3"],"ghsa_id":"GHSA-gcqf-f89c-68hv","id":"tcs_01M5KG8DJ89NRMAEG3SCYTRPYJ","modified_at":"2026-07-27T09:11:29.300565599Z","published_at":"2025-05-06T15:37:19Z","references":["https://osv.dev/vulnerability/GO-2025-3663","https://github.com/advisories/GHSA-gcqf-f89c-68hv","https://nvd.nist.gov/vuln/detail/CVE-2025-4166","https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GO-2025-3663","url":"https://osv.dev/vulnerability/GO-2025-3663"},{"source":"nvd","source_id":"CVE-2025-4166","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4166"}],"summary":"Hashicorp Vault Community vulnerable to Generation of Error Message Containing Sensitive Information in github.com/hashicorp/vault"}