Description

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T20:16:50.020Z",
  "pubdate": "2026-08-07T20:16:50.020Z",
  "executiveSummary": "Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2 contain a denial of service vulnerability identified as CVE-2026-15972. The flaw exists due to unbounded connection acceptance on the external gRPC listeners, allowing an unauthenticated remote attacker to exhaust critical system resources on targeted Consul agents. By opening a large volume of incomplete connections, malicious actors can deplete available agent file descriptors, goroutines, and memory pools. This resource exhaustion state prevents legitimate clients from establishing connections or communicating with the Consul cluster, severely disrupting service availability. Exploitation requires network access to the external gRPC listeners, but does not require authentication or elevated privileges, making it a significant risk for publicly or broadly exposed infrastructure. Remediation requires updating the affected software to the patched version releases provided by the vendor.",
  "technicalDetails": "CVE-2026-15972 stems from improper resource management and connection limiting mechanisms within the external gRPC listeners of Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2. Specifically, the vulnerable component lacks adequate thresholds or rate-limiting controls when accepting inbound gRPC connection streams from external sources prior to full handshake completion or session establishment. Network exposure is defined by the accessibility of the external gRPC listeners over the network. An unauthenticated remote attacker with network visibility to these listeners can initiate repeated connection attempts without satisfying authentication prerequisites, as authentication is bypassed or unrequired at this stage of the connection lifecycle. The exploitation method relies on payload behavior involving incomplete connections. The attacker opens numerous TCP and gRPC streams simultaneously and keeps them in a half-open or stalling state, deliberately failing to finalize the protocol handshake or payload transmission. Because the application layer unbounded connection acceptance logic continues to spawn handlers, allocate memory, initialize goroutines, and consume operating system file descriptors for every incoming connection attempt without enforcing strict timeouts or connection caps, the host system rapidly hits its resource ceilings. Once file descriptors, memory, and goroutines are exhausted, the Consul agent process becomes incapable of allocating new resources for legitimate administrative or client traffic, leading to an effective denial of service condition across the affected agent node."
}