Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-87106

Consul vulnerable to a denial of service in the native RPC listener

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

  • 1.21.0 to < 2.0.4affected

HashiCorp Consul Enterprise

Default version status: unaffected

  • 1.21.0 to < 2.0.4affected

References