What is the CVSS score of CVE-2026-19014?

CVE-2026-19014 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-19014?

Yes, a patch is available for CVE-2026-19014. Update the affected software to the latest version immediately.

HashiCorp Consul CVE-2026-19014

EUVD-2026-54607 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-07 HashiCorp

GHSA-rwp8-hj7g-qrh8

Denial Of Service Hashicorp HashiCorp Consul Consul Enterprise

4.3

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires authenticated low-privilege caller; cache exhaustion yields partial availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 20:24 vuln.today

Patch available

Aug 07, 2026 - 20:01 EUVD

DescriptionCVE.org

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

AnalysisAI

Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated network callers to unboundedly inflate the Consul agent's intention-match cache via the Connect authorization endpoint, defeating explicitly configured cache-disable operator settings. This CWE-770 flaw degrades service mesh authorization availability and undermines a deliberate operational control. No public exploit code or active exploitation has been identified; HashiCorp has released patches across all affected release lines.

Technical ContextAI

HashiCorp Consul is a widely deployed service mesh and service discovery platform. Its Connect feature enforces service-to-service authorization through 'intentions' - policy rules governing which services may communicate. The Consul agent maintains an intention-match cache to optimize the performance of these authorization lookups. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause class: the Connect authorization endpoint does not impose an upper bound on cache entry growth per caller or in aggregate, meaning an authenticated caller can populate the cache without ceiling regardless of the operator's cache-disable configuration. Both the community edition (CPE: cpe:2.3:a:hashicorp:consul) and enterprise edition (CPE: cpe:2.3:a:hashicorp:consul_enterprise) share the same vulnerable code path across versions 1.17.0 through 2.0.2.

RemediationAI

Upgrade to Consul 2.0.3 (community edition) or Consul Enterprise 1.21.17, 1.22.11, or 2.0.3 depending on your active release track, as confirmed by HashiCorp's advisory at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. If immediate patching is not feasible, restrict access to the Connect authorization endpoint to the minimal set of authenticated service accounts required for mesh operation - this narrows the attacker pool but does not eliminate the vulnerability and may require ACL policy changes with associated operational overhead. As an additional compensating control, rate-limiting calls to the Connect authorization endpoint at the network perimeter or via a sidecar proxy can constrain the rate of cache growth, though this introduces latency for legitimate authorization lookups and does not fully remediate the root cause.