CVE-2026-15972
Received Received - Intake

Denial of Service in Consul Community and Enterprise

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HashiCorp Inc.

Description
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-15972
EUVD
EUVD-2026-54612

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
hashicorp consul to 2.0.3 (exc)
hashicorp consul 2.0.3
hashicorp consul_enterprise 1.21.17
hashicorp consul_enterprise 1.22.11
hashicorp consul_enterprise 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 have an unauthenticated denial of service vulnerability. Attackers can exploit this by opening many incomplete connections to the external gRPC listeners, which exhausts agent file descriptors, goroutines, and memory. This prevents legitimate clients from connecting.

Detection Guidance

Monitor for unusually high numbers of incomplete gRPC connections on Consul's external listeners. Check system file descriptor limits and goroutine usage with commands like 'lsof -i' or 'netstat -an | grep <consul_port>'. Inspect Consul logs for errors indicating connection exhaustion or resource limits being hit.

Impact Analysis

This vulnerability allows remote attackers to disrupt service availability by overwhelming system resources. It can cause legitimate clients to fail connecting, leading to service outages and degraded performance for applications relying on Consul.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. GDPR requires availability of personal data processing systems, while HIPAA mandates reliable access to protected health information. The DoS risk may violate these requirements if critical systems become unavailable.

Mitigation Strategies

Upgrade Consul to version 2.0.3 or Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 immediately. If upgrading is not possible, restrict access to the gRPC listener ports using firewalls or network policies to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart