CVE-2026-19015
Received Received - Intake

Uncontrolled Resource Consumption in Consul

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HashiCorp Inc.

Description
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19015
EUVD
EUVD-2026-54608

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
hashicorp consul From 1.2.0 (inc) to 2.0.2 (inc)
hashicorp consul 2.0.3
hashicorp consul_enterprise 1.21.17
hashicorp consul_enterprise 1.22.11
hashicorp consul_enterprise 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 have an uncontrolled resource consumption issue in the Connect CA roots endpoint. This allows a remote attacker to continuously grow the agent's Connect CA roots cache beyond normal limits, even when the operator has disabled caching. The issue defeats the intended cache-disable configuration.

Detection Guidance

To detect this vulnerability, check if your Consul version is between 1.2.0 and 2.0.2. Run 'consul version' to verify. If affected, monitor the Connect CA roots endpoint for unusual cache growth or resource usage.

Impact Analysis

This vulnerability may cause the Consul agent to consume excessive memory and CPU resources due to the unbounded cache growth. This can lead to degraded performance, potential crashes, or service disruption in environments running affected Consul versions.

Compliance Impact

This vulnerability may lead to uncontrolled resource consumption, potentially causing service disruptions or degraded performance in systems handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it might affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Consul to version 2.0.3 or Consul Enterprise to versions 1.21.17, 1.22.11, or 2.0.3 to address the uncontrolled resource consumption issue in the Connect CA roots endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19015. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart