EUVD-2026-54613
GHSA-27m6-255m-6q58
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-accessible HTTP API requires no authentication; impact is availability-only and partial since memory is eventually reclaimed after request rejection.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
AnalysisAI
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to force the agent to allocate substantial memory before a request is finally rejected. Both Community Edition and Enterprise versions 1.3.0 through 2.0.2 are affected, covering a multi-year release window. No public exploit has been identified and the vulnerability is absent from CISA KEV, but the zero-authentication, low-complexity network attack path makes it straightforward to trigger for any attacker with network access to the Consul agent API port.
Technical ContextAI
HashiCorp Consul is a distributed service mesh and service discovery platform widely used in cloud-native and microservices architectures. The vulnerable surface is the Consul agent HTTP API layer - the interface responsible for service registration, health checking, key/value operations, and cluster coordination, typically listening on TCP port 8500 (HTTP) or 8501 (HTTPS). CPE strings cpe:2.3:a:hashicorp:consul and cpe:2.3:a:hashicorp:consul_enterprise confirm both distribution channels are affected identically. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause class: affected API endpoints lack sufficient early-stage input validation or request-body size enforcement, allowing the agent runtime to allocate memory proportional to a malicious payload before bounds checking triggers rejection. This is distinct from a crash or code execution; the process remains alive but can be memory-starved under sustained request load.
RemediationAI
Upgrade to Consul Community Edition 2.0.3 or, for Enterprise deployments, to the appropriate patched Enterprise release: 1.21.17 for 1.21.x tracks, 1.22.11 for 1.22.x tracks, or 2.0.3 for 2.0.x tracks, as confirmed by HashiCorp's HCSEC-2026-25 advisory at https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629. As a compensating control prior to patching, restrict network access to Consul agent HTTP API ports (default 8500/8501) using host-based firewall rules or network segmentation so only trusted internal hosts can reach the API - this is also Consul's recommended production posture regardless of this vulnerability. Note that restricting API access may affect service discovery clients, sidecars, monitoring tools, or CI pipelines that interact directly with the agent API; audit dependent tooling before applying network restrictions. Binding the HTTP API listener to localhost (client_addr = "127.0.0.1" in agent config) is an additional hardening measure where remote API access is not required.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today