EUVD-2026-75680
GHSA-q5mw-fjrj-6qmh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
PR:L reflects the mTLS certificate requirement; AC:L because exploitation is deterministic once credentials are held; C:N/I:N as only server availability is impacted.
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
AnalysisAI
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid TLS client certificate trusted by the target Consul cluster's CA - sufficient to complete the internal RPC mTLS handshake - and network-level reachability to the native RPC listener (default TCP port 8300). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the nature of this issue: network-accessible, low-complexity, requiring only low-level credentials (valid mTLS client certificate), with purely availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Consul open-source to version 2.0.4 or Consul Enterprise to 1.21.18, 1.22.12, or 2.0.4 depending on your release track, as documented in HashiCorp advisory HCSEC-2026-35 (https://discuss.hashicorp.com/t/hcsec-2026-35-consul-vulnerable-to-a-denial-of-service-in-the-native-rpc-listener/77737). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Consul Enterprise
View allAuthorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-wri
Unauthenticated denial of service in HashiCorp Consul's external gRPC listeners allows remote attackers to exhaust agent
Authorization bypass in HashiCorp Consul's Connect service mesh allows a low-privileged authenticated service to communi
Partial arbitrary file read in HashiCorp Consul Community Edition and Enterprise 1.18.21 through 2.0.2 allows a network-
Authorization bypass in Consul's catalog deregistration path allows authenticated low-privileged callers to delete servi
Uncontrolled memory consumption in HashiCorp Consul's agent HTTP API endpoints allows unauthenticated remote callers to
Uncontrolled cache growth in HashiCorp Consul's Connect CA roots endpoint allows unauthenticated remote callers to expan
Authenticated denial of service in HashiCorp Consul Community Edition and Consul Enterprise 1.18.0-2.0.2 allows a networ
Uncontrolled resource consumption in HashiCorp Consul and Consul Enterprise 1.17.0 through 2.0.2 allows authenticated ne
Authorization bypass in HashiCorp Consul and Consul Enterprise versions 1.19.1 through 2.0.2 allows authenticated caller
L7 intention authorization bypass in HashiCorp Consul Community and Enterprise editions 1.20.1 through 2.0.2 allows an a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today