Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-15972

Unauthenticated denial of service via unbounded external gRPC connection acceptance

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.13.0 to < 2.0.3affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.13.0 to < 2.0.3affected

References