Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-105626

Consul vulnerable to a denial of service in HTTP APIs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 0.6.0 to < 2.1.0affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 0.6.0 to < 2.1.0affected

References