CVE-2025-11375
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-28

Last updated on: 2025-12-22

Assigner: HashiCorp Inc.

Description
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-28
Last Modified
2025-12-22
Generated
2026-06-16
AI Q&A
2025-10-28
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11375
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
hashicorp consul to 1.18.12 (exc)
hashicorp consul to 1.22.0 (exc)
hashicorp consul From 1.19.0 (inc) to 1.20.8 (exc)
hashicorp consul From 1.21.0 (inc) to 1.21.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Consul and Consul Enterprise affects the event endpoint, which does not enforce a maximum limit on the Content Length header. This allows an attacker to send very large requests that can cause a denial of service (DoS) by overwhelming the system.

Impact Analysis

The vulnerability can lead to a denial of service (DoS) condition, making the Consul service unavailable or unresponsive, which can disrupt operations relying on Consul for service discovery or configuration.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Consul Community Edition to version 1.22.0 or later, or Consul Enterprise to versions 1.22.0, 1.21.6, 1.20.8, or 1.18.12 or later.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart