{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/consul-community-edition--2.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*","cpe:2.3:a:hashicorp:consul_enterprise:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-105626"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Consul Community Edition (\u003c 2.1.0)","Consul Enterprise (\u003c 2.1.0, \u003c 1.21.19)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","hashicorp","vulnerability"],"_cs_type":"advisory","_cs_vendors":["HashiCorp"],"content_html":"\u003cp\u003eHashiCorp Consul and Consul Enterprise contain a denial of service (DoS) vulnerability in the HTTP API. An unauthenticated attacker can send crafted requests to the HTTP API, leading to uncontrolled memory exhaustion on the Consul agent process. This impacts both the Community and Enterprise editions of the product. The vulnerability is assigned CVE-2026-105626 with a CVSS v3.1 base score of 7.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in memory exhaustion on the Consul agent, which causes the service to crash or become unresponsive, leading to denial of service for any applications relying on the agent for service discovery or key-value store access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch HashiCorp Consul to the following versions immediately:\u003c/li\u003e\n\u003cli\u003eConsul Community Edition: Upgrade to version 2.1.0 or later.\u003c/li\u003e\n\u003cli\u003eConsul Enterprise: Upgrade to version 2.1.0 or version 1.21.19 or later.\u003c/li\u003e\n\u003cli\u003eAudit access to the Consul HTTP API. Ensure that the API is not exposed to untrusted networks and utilize ACLs to restrict unauthenticated access to the HTTP endpoint where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-26T19:45:10Z","date_published":"2026-10-26T19:45:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hashicorp-consul-dos/","summary":"An unauthenticated denial of service vulnerability in the HashiCorp Consul HTTP API allows remote attackers to exhaust memory on target agents, leading to service unavailability.","title":"HashiCorp Consul: HTTP API denial of service (CVE-2026-105626)","url":"https://feed.craftedsignal.io/briefs/2026-10-hashicorp-consul-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Consul Community Edition (\u003c 2.1.0)","version":"https://jsonfeed.org/version/1.1"}