Consul Enterprise (< 2.1.0, < 1.21.19) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/consul-enterprise--2.1.0--1.21.19/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 26 Oct 2026 19:45:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHashiCorp Consul: HTTP API denial of service (CVE-2026-105626)https://feed.craftedsignal.io/briefs/2026-10-hashicorp-consul-dos/Mon, 26 Oct 2026 19:45:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-hashicorp-consul-dos/An unauthenticated denial of service vulnerability in the HashiCorp Consul HTTP API allows remote attackers to exhaust memory on target agents, leading to service unavailability.HashiCorp Consul and Consul Enterprise contain a denial of service (DoS) vulnerability in the HTTP API. An unauthenticated attacker can send crafted requests to the HTTP API, leading to uncontrolled memory exhaustion on the Consul agent process. This impacts both the Community and Enterprise editions of the product. The vulnerability is assigned CVE-2026-105626 with a CVSS v3.1 base score of 7.5.

Impact

Successful exploitation results in memory exhaustion on the Consul agent, which causes the service to crash or become unresponsive, leading to denial of service for any applications relying on the agent for service discovery or key-value store access.

Recommendation

  • Patch HashiCorp Consul to the following versions immediately:
  • Consul Community Edition: Upgrade to version 2.1.0 or later.
  • Consul Enterprise: Upgrade to version 2.1.0 or version 1.21.19 or later.
  • Audit access to the Consul HTTP API. Ensure that the API is not exposed to untrusted networks and utilize ACLs to restrict unauthenticated access to the HTTP endpoint where possible.
]]>lowadvisorydenial-of-servicehashicorpvulnerability