Description

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T20:16:50.787Z",
  "pubdate": "2026-08-07T20:16:50.787Z",
  "executiveSummary": "CVE-2026-19113 is an unauthenticated denial of service vulnerability affecting Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2.\nThe vulnerability resides in several agent HTTP API endpoints, allowing a remote attacker to induce substantial memory consumption on the Consul agent prior to request rejection.\nThe primary impact of successful exploitation is resource exhaustion leading to service disruption or crashes, affecting the availability of the Consul cluster nodes.\nThe risk implication is critical for environments exposing the Consul agent HTTP API to untrusted networks without adequate perimeter defenses or authentication controls.\nAttacker capabilities require remote network access to vulnerable agent HTTP API endpoints without requiring authentication or prior privileges.\nExploitation requirements include the ability to transmit specially crafted HTTP requests to the target Consul agent endpoints, forcing the application to buffer or process excessive data before validation logic terminates the transaction.",
  "technicalDetails": "The root cause of CVE-2026-19113 stems from improper resource management and validation within several agent HTTP API endpoints in Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2.\nThe vulnerable components are specific HTTP API handlers within the Consul agent that fail to enforce strict size limits or early validation on incoming requests, allowing unauthenticated remote callers to stream or submit oversized payloads.\nThe attack flow proceeds as follows: First, a remote attacker identifies an exposed Consul agent HTTP API endpoint susceptible to the flaw. Second, the attacker transmits an unauthenticated HTTP request containing a payload designed to maximize memory allocation. Third, the Consul agent accepts the incoming data stream and allocates substantial system memory to process or buffer the request before evaluating security constraints or rejecting the payload. Finally, repeated or concurrent execution of this pattern exhausts available system memory, leading to an agent crash or system-wide denial of service.\nAuthentication requirements are absent, as the vulnerability affects unauthenticated HTTP API endpoints. Privilege requirements are nonexistent, as external callers do not need pre-existing roles or ACL tokens to interact with the affected routes.\nNetwork exposure is inherent to any Consul agent configuration where the HTTP API is accessible to remote callers over the network, particularly if bound to external network interfaces rather than localhost.\nThe payload behavior forces memory exhaustion through disproportionate heap allocation during the initial parsing or buffering phase of the HTTP request lifecycle.\nThe post-exploitation impact is strictly limited to availability, manifesting as denial of service via memory exhaustion, but does not inherently provide remote code execution, privilege escalation, or unauthorized data access based on the provided vulnerability description."
}