CVE-2026-105626: Consul vulnerable to a denial of service in HTTP APIs
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Consul Community Editionto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.19
Event History
Frequently Asked Questions
Which deployments are affected?
HashiCorp Consul Community Edition and Consul Enterprise are affected. The issue is fixed in Community Edition 2.1.0 and Enterprise 2.1.0 and 1.21.19.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the HTTP API without user interaction, and the attack has low complexity.
What is the expected impact of successful exploitation?
An attacker may exhaust memory on a Consul agent, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.