Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-19015

Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.2.0 to < 2.0.3affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.2.0 to < 2.0.3affected

References