Denial of Service in HashiCorp Consul and Consul Enterprise APIs
CVE-2026-105626

7.5HIGH

Key Information:

Vendor

Hashicorp
Status
Consul
Consul Enterprise
Vendor
CVE Published:
26 October 2026

What is CVE-2026-105626?

HashiCorp Consul and Consul Enterprise are susceptible to a denial of service attack through their HTTP API. An unauthenticated attacker can exploit this vulnerability to continuously consume memory on a Consul agent, potentially leading to service disruption. The vulnerability has been addressed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19, making it essential for users to upgrade to these versions to ensure the integrity and availability of their Consul instances.

Affected Version(s)

Consul 64 bit 0.6.0 < 2.1.0

Consul Enterprise 64 bit 0.6.0 < 2.1.0

References

https://discuss.hashicorp.com/t/hcsec-2026-48-consul-vuln...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was reported to HashiCorp by Immad Sahin of ZeroTrail.
.