CVE-2026-87106: Consul vulnerable to a denial of service in the native RPC listener
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Consulto a version that resolves this vulnerability.Fixed in 2.0.4 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.21.18 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.22.12 - Upgrade
Upgrade
Consul Enterpriseto a version that resolves this vulnerability.Fixed in 2.0.4 - Compensating control
Mitigate the native RPC listener DoS by restricting network access to the native RPC endpoint so unauthorised/unauthenticated clients cannot complete the internal RPC mTLS handshake (e.g., via firewall/ACL) until all servers are upgraded.
Event History
Frequently Asked Questions
Which clients can exploit this issue without a valid ACL token?
Any client able to complete the internal RPC mutual-TLS handshake may exploit the issue. ACL authorization is evaluated only after the memory-exhaustion condition can be triggered, so a valid ACL token is not required.
What is the operational impact of successful exploitation?
An authenticated client can exhaust Consul server memory through the native RPC listener, causing a denial of service. The provided severity vector indicates availability impact only; no confidentiality or integrity impact is identified.
Which releases contain the fix?
The issue is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.