EUVD-2026-54612
GHSA-699f-92f5-m297
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-exposed gRPC listener requires no credentials; only availability is impacted via resource exhaustion; scope unchanged as impact is confined to the Consul agent process.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent file descriptors, goroutines, and memory by flooding incomplete connections, rendering the agent unreachable to legitimate clients. Both Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 are affected - a span covering nearly three years of releases. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 7.5 score and AV:N/AC:L/PR:N profile reflect a straightforwardly exploitable network condition requiring no attacker authentication or user interaction.
Technical ContextAI
HashiCorp Consul is a widely deployed service mesh and service discovery platform that exposes external gRPC listeners for agent-to-agent and client-to-agent communication. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): Consul's gRPC listener accepts inbound TCP connections without enforcing a cap on the number of incomplete or half-open connections. Each connection accepted but not completed consumes a file descriptor, a goroutine, and heap memory in the Go runtime. Because the listener does not reject or time out these incomplete connections aggressively enough, a sustained flood saturates process-level resource pools. Affected CPEs are cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:* and cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:*, covering both the open-source and enterprise distributions from 1.13.0 onward.
RemediationAI
Upgrade to Consul Community Edition 2.0.3 or, for Consul Enterprise deployments, to one of the fixed branches: 1.21.17, 1.22.11, or 2.0.3. These exact patch versions are confirmed by HashiCorp advisory HCSEC-2026-25 at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. If immediate patching is not feasible, restrict network access to Consul's gRPC listener ports (default 8503 for TLS and 8502 for plaintext) using host-based firewall rules or network ACLs, limiting access to known trusted Consul agent IP ranges only. This workaround reduces attack surface but does not eliminate the underlying flaw and may disrupt legitimate cross-segment Consul communication, requiring careful inventory of which hosts require gRPC access before applying.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today