HashiCorp Consul EUVD-2026-54613

The Consul agent HTTP API must be network-reachable from the attacker - by default this listens on TCP port 8500 (HTTP) or 8501 (HTTPS). No authentication token or client certificate is required to trigger the vulnerability, consistent with CVSS PR:N. The affected versions span 1.3.0 through 2.0.2 for both Community and Enterprise editions; deployments on 2.0.3+ or the respective Enterprise fix versions are not affected. Exploitation requires sustained request volume to maintain memory pressure, as the agent eventually rejects each individual malicious request and reclaims memory - a single request is insufficient for meaningful impact. The primary limiting factor for most production deployments is network segmentation: Consul's own operational guidance recommends the agent API not be exposed to untrusted networks, and environments enforcing this posture (firewall rules, private VPC placement, or client_addr bound to localhost) are not practically exploitable.

The NVD CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects the attack profile: network-reachable, zero authentication, no user interaction, no complexity barrier, but impact limited to partial availability (A:L). The A:L rating is significant - it implies degradation rather than complete service crash, as the agent ultimately rejects the malicious request and memory is eventually reclaimed. No EPSS score was provided in available intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is not listed in CISA KEV and no public POC has been identified, indicating no confirmed widespread active exploitation at time of analysis. Despite the medium CVSS, the real-world risk is elevated for any deployment where the Consul agent HTTP API is reachable from untrusted networks, since attack complexity is genuinely low and no credential is required. Environments following Consul's recommended deployment posture - API bound to localhost or restricted via ACLs and network controls - face substantially lower exposure.

An unauthenticated remote attacker with network access to the Consul agent HTTP API port sends a series of crafted HTTP requests to one or more of the vulnerable API endpoints, causing each request to trigger significant memory allocation within the agent process before the request is rejected. By sustaining a high volume of such requests, the attacker drives the agent's memory consumption upward, degrading or temporarily disrupting its ability to serve legitimate service discovery and health-check operations. No public POC has been identified, but the attack requires no authentication and no special tooling beyond a standard HTTP client.