CVE-2026-19113
Received Received - Intake

Unauthenticated Denial of Service in Consul

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HashiCorp Inc.

Description
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-19113
EUVD
EUVD-2026-54613

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
hashicorp consul 1.3.0
hashicorp consul 2.0.2
hashicorp consul 2.0.3
hashicorp consul_enterprise 1.21.17
hashicorp consul_enterprise 1.22.11
hashicorp consul_enterprise 2.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 have an unauthenticated denial of service vulnerability in several agent HTTP API endpoints. A remote attacker can send specially crafted requests that cause the agent to consume large amounts of memory before the request is rejected, leading to service disruption.

Detection Guidance

To detect this vulnerability, check the Consul agent version running on your system. If it is between 1.3.0 and 2.0.2, it is vulnerable. Run 'consul version' to verify the installed version.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to disrupt Consul services by causing high memory consumption, potentially leading to service outages or degraded performance for systems relying on Consul for service discovery and configuration.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires maintaining system availability, while HIPAA mandates safeguards against service disruptions. The vulnerability may lead to unauthorized resource exhaustion, potentially violating these requirements.

Mitigation Strategies

Upgrade Consul Community Edition to version 2.0.3 or higher. For Consul Enterprise, upgrade to versions 1.21.17, 1.22.11, or 2.0.3 or higher. This addresses the unauthenticated denial of service vulnerability in agent HTTP API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart