CVE-2026-19014
Received Received - Intake

Uncontrolled Resource Consumption in Consul

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HashiCorp Inc.

Description
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19014
EUVD
EUVD-2026-54607

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
hashicorp consul From 1.17.0 (inc) to 2.0.2 (inc)
hashicorp consul 2.0.3
hashicorp consul_enterprise 1.21.17
hashicorp consul_enterprise 1.22.11
hashicorp consul_enterprise 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 have an uncontrolled resource consumption issue in the Connect authorization endpoint. This flaw allows a caller to continuously grow the agent's intention-match cache without any limit, which can bypass the operator's cache-disable configuration.

Impact Analysis

This vulnerability may cause the Consul agent to consume excessive memory due to the unbounded cache growth. This can lead to degraded performance, potential crashes, or denial of service conditions for the affected Consul deployment.

Compliance Impact

This vulnerability may lead to uncontrolled resource consumption, potentially causing service disruptions or degraded performance in systems handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it might affect the integrity and availability of protected health information systems. However, the provided CVE data does not explicitly detail compliance impacts.

Mitigation Strategies

Upgrade Consul Community Edition to version 2.0.3 or later. For Consul Enterprise, upgrade to versions 1.21.17, 1.22.11, or 2.0.3 or later to address the uncontrolled resource consumption issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19014. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart