Medium
Security advisory
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2022-41316
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:25 UTC · Revision 1
Source evidence
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
osv:CVE-2022-41316
Complete source record
{
"id": "4656238392de7349c3fe15b8cc7d0741875b97aed4f07b3fbc12f6b81b8cb7b5",
"url": "https://osv.dev/vulnerability/CVE-2022-41316",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2022-41316",
"summary": "HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.",
"evidence": "osv:CVE-2022-41316",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2022-41316",
"aliases": [
"BIT-vault-2022-41316",
"CVE-2022-41316",
"GHSA-9mh8-9j64-443f",
"GO-2023-1897"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/hashicorp/vault",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8efbff550621e280f8a052bacd2327385dbcd877"
},
{
"introduced": "7738ec5d0d6f5bf94a809ee0f6ff0142cfa525a6"
},
{
"fixed": "f7968a9e62f03dc52ef961ac4b8d7d7e40d48aa0"
},
{
"introduced": "ea296ccf58507b25051bc0597379c467046eb2f1"
},
{
"fixed": "b47a9e72942719f217f7750df18be36ec21dfc0e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.9.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.9.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.10.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "1.11.0"
},
{
"fixed": "1.11.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "1.11.0"
},
{
"fixed": "1.11.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.10.6",
"v1.11.3",
"v1.9.9",
"v1.11.2",
"v1.10.5",
"v1.9.8",
"v1.11.1",
"v1.11.0",
"v1.10.4",
"v1.9.7",
"v1.10.3",
"v1.9.6",
"v1.10.2",
"v1.9.5",
"v1.10.1",
"v1.10.0",
"v1.9.4",
"v1.9.3",
"v1.9.2",
"v1.9.1",
"main-creation",
"v1.9.0",
"v1.9.0-rc1",
"sdk/v0.3.0",
"api/v1.2.0",
"api/v1.1.1",
"sdk/v0.2.1",
"v1.2.0",
"v1.2.0-rc1",
"api/v1.0.4",
"sdk/v0.1.13",
"api/v1.0.3",
"sdk/v0.1.12",
"v1.2.0-beta2",
"v1.2.0-beta1",
"sdk/v0.1.11",
"sdk/v0.1.10",
"api/v1.0.2",
"v1.1.1",
"sdk/v0.1.9",
"api/v1.0.1",
"sdk/v0.1.8",
"v1.1.0",
"v1.1.0-beta2",
"v1.1.0-beta1",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v0.10.2",
"v1.0.0",
"v1.0.0-rc1",
"v1.0.0-beta2",
"v1.0.0-beta1",
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.11.0-beta1",
"v0.10.4",
"v0.10.3",
"v0.10.1",
"v0.10.0",
"v0.10.0-rc1",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.8.0-rc1",
"v0.8.0-beta1",
"v0.7.3",
"v0.7.2",
"v0.7.1",
"v0.6.5",
"v0.7.0",
"v0.7.0-beta1",
"v0.6.4",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.1-rc3",
"v0.6.1-rc2",
"v0.6.1-rc1",
"v0.6.0-rebuild",
"v0.6.0",
"v0.6.0-rc1",
"v0.5.2",
"v0.6.0-beta2",
"v0.6.0-beta1",
"v0.5.1",
"v0.5.0",
"v0.5.0-rc2",
"v0.5.0-rc1.2",
"v0.5.0-rc1.1",
"v0.5.0-rc1",
"v0.4.0",
"v0.4.0-rc1",
"v0.3.1",
"v0.3.0",
"v0.3.0-rc",
"v0.2.0",
"v0.2.0.rc1",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41316.json"
}
}
],
"modified": "2026-10-28T02:30:22.007172115Z",
"provider": "osv",
"references": [
"https://discuss.hashicorp.com",
"https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41316.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-41316",
"https://security.netapp.com/advisory/ntap-20221201-0001/"
],
"provider_metadata": {
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41316.json"
}
},
"related_cves": [
{
"value": "CVE-2022-41316",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488328,
"published_at": "2022-10-12T00:00:00+00:00"
}