CVE-2026-105626 in Consul
Summary
by MITRE • 10/26/2026
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The HashiCorp Consul platform, a critical service mesh and infrastructure orchestration tool used extensively for service discovery, configuration, and key-value storage across distributed systems, contains a significant security flaw within its HTTP API layer that poses a severe risk to system availability. This vulnerability allows an unauthenticated attacker to trigger a denial of service condition by exploiting improper resource management during the processing of specific HTTP requests. The core technical issue stems from how the Consul agent handles incoming data or connection states without adequate validation or limits, leading to excessive memory allocation for each malicious request. Because this endpoint is accessible over the network and does not require authentication in default configurations, any external actor can target it directly. This lack of access control combined with inefficient resource handling creates a straightforward attack vector that requires minimal effort from an adversary but yields high impact on the targeted infrastructure components.
From a technical perspective, the flaw represents a classic case of insufficient input validation and resource exhaustion logic within the application layer. When an attacker sends crafted HTTP requests to the vulnerable API endpoint, the Consul agent allocates memory buffers or data structures that are not properly released or bounded in size. Over time, as these malicious requests accumulate, the agent's process consumes increasing amounts of system RAM until it reaches its limit. This state typically results in the application becoming unresponsive, crashing, or being terminated by the operating system’s out-of-memory killer mechanism. The impact is immediate and disruptive to any services relying on Consul for discovery or configuration updates during this period. Since Consul often serves as a central nervous system for microservices architectures, its downtime can cascade into broader service failures across the entire environment, effectively halting business operations that depend on real-time service registration and health checking capabilities.
This vulnerability aligns with CWE-400, which describes conditions where resources are not properly limited or controlled, leading to resource exhaustion. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1498, Network Denial of Service, specifically the sub-category involving direct network flooding or application-layer attacks that consume server-side resources rather than just bandwidth. The unauthenticated nature of the exploit means it falls under initial access vectors where no prior compromise is needed, making it particularly dangerous in environments exposed to public networks or poorly segmented internal segments. Attackers can automate this process using simple scripts to send a high volume of requests, ensuring sustained pressure on the target system’s memory resources until service degradation occurs.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. The primary defense is to apply the vendor-provided patches immediately by upgrading Consul Community Edition to version 2.1.0 or later, or Consul Enterprise to versions 2.1.0 or 1.21.19 and beyond. These updates contain code changes that enforce stricter limits on request processing and ensure proper memory deallocation after handling API calls. In addition to patching, organizations should implement network-level controls such as rate limiting at the load balancer or reverse proxy layer preceding Consul agents. This helps throttle excessive traffic from any single source before it reaches the vulnerable application logic. Furthermore, ensuring that the HTTP API endpoints are not exposed directly to untrusted networks by restricting access via firewall rules or service mesh policies adds a crucial defense-in-depth layer. Regular auditing of network exposure and continuous monitoring for anomalous memory usage patterns on Consul hosts can also aid in early detection and response to potential exploitation attempts before significant damage occurs.