What is the CVSS score of CVE-2026-19015?

CVE-2026-19015 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-19015?

Yes, a patch is available for CVE-2026-19015. Update the affected software to the latest version immediately.

HashiCorp Consul CVE-2026-19015

EUVD-2026-54608 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-07 HashiCorp

GHSA-hhvm-wg9j-9rp7

Denial Of Service Hashicorp HashiCorp Consul Consul Enterprise

5.3

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

5.3 MEDIUM

Connect CA roots endpoint is network-accessible without authentication; sole impact is low availability via unbounded cache growth, with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 20:24 vuln.today

Patch available

Aug 07, 2026 - 20:01 EUVD

DescriptionCVE.org

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

AnalysisAI

Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expand the agent's Connect CA roots cache indefinitely, overriding any operator-applied cache-disable configuration. Both Consul Community Edition and Consul Enterprise are affected from version 1.2.0 through 2.0.2. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium rating reflects limited availability impact with no confidentiality or integrity exposure.

Technical ContextAI

HashiCorp Consul's Connect feature provides service mesh capabilities using mutual TLS (mTLS), anchored by a Certificate Authority (CA) whose root certificates are served via the Connect CA roots endpoint. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the endpoint lacks resource constraints on how many CA root entries are accumulated in the agent's in-memory cache. Critically, this growth persists even when operators have explicitly disabled the cache via configuration, rendering that control ineffective. Affected products are identified by CPEs cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:* and cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:*, covering both the open-source Community Edition and commercial Enterprise variants.

RemediationAI

Upgrade to Consul Community Edition 2.0.3 or Consul Enterprise 1.21.17, 1.22.11, or 2.0.3, as confirmed by HashiCorp in the vendor advisory at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. If an immediate upgrade is not feasible, operators should restrict network access to the Connect CA roots endpoint using firewall rules or Consul ACL policies to limit which callers can reach it, thereby reducing the attack surface; this does not fix the underlying cache growth bug but limits who can trigger it. Disabling the Connect feature entirely is a more aggressive workaround that eliminates exposure but removes service mesh functionality. Note that the current operator cache-disable configuration is explicitly ineffective against this vulnerability and should not be relied upon as a compensating control.