HashiCorp Consul: HTTP API denial of service (CVE-2026-105626)
An unauthenticated denial of service vulnerability in the HashiCorp Consul HTTP API allows remote attackers to exhaust memory on target agents, leading to service unavailability.
CVE search metadata
CVE search record: CVE-2026-105626. Severity: high. CVSS: 7.5. KEV: no. Product: Consul Community Edition (< 2.1.0), Consul Enterprise (< 2.1.0, < 1.21.19). Brief: HashiCorp Consul: HTTP API denial of service (CVE-2026-105626). Brief link: https://feed.craftedsignal.io/briefs/2026-10-hashicorp-consul-dos/
Triage facts
Revision 1- Applicability
- Consul Community Edition (< 2.1.0), Consul Enterprise (< 2.1.0, < 1.21.19)
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 26, 19:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
HashiCorp Consul and Consul Enterprise contain a denial of service (DoS) vulnerability in the HTTP API. An unauthenticated attacker can send crafted requests to the HTTP API, leading to uncontrolled memory exhaustion on the Consul agent process. This impacts both the Community and Enterprise editions of the product. The vulnerability is assigned CVE-2026-105626 with a CVSS v3.1 base score of 7.5.
Impact
Successful exploitation results in memory exhaustion on the Consul agent, which causes the service to crash or become unresponsive, leading to denial of service for any applications relying on the agent for service discovery or key-value store access.
Recommendation
- Patch HashiCorp Consul to the following versions immediately:
- Consul Community Edition: Upgrade to version 2.1.0 or later.
- Consul Enterprise: Upgrade to version 2.1.0 or version 1.21.19 or later.
- Audit access to the Consul HTTP API. Ensure that the API is not exposed to untrusted networks and utilize ACLs to restrict unauthenticated access to the HTTP endpoint where possible.
Immediate actions
Upgrade Consul Community Edition to 2.1.0 and Consul Enterprise to 2.1.0 or 1.21.19
Threat Hunt
Monitor for spikes in agent memory usage or service crashes associated with high volumes of HTTP API traffic
Data: Consul agent log files (process termination events), System metrics (memory usage per process), Web server / API gateway access logs
Mitigations
Restrict network access to Consul HTTP API endpoints to trusted management CIDRs
CVE-2026-105626