CVE-2026-19015 in Consul
Summary
by MITRE • 08/07/2026
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described in CVE-2026-19015 represents a critical resource exhaustion flaw affecting HashiCorp Consul Community Edition and Enterprise versions ranging from 1.2.0 through 2.0.2. This issue resides within the Connect CA roots endpoint functionality, which serves as a core component of Consul's service mesh capabilities. The flaw enables remote attackers to continuously expand the agent's Connect CA roots cache beyond operational limits, effectively circumventing configured cache restrictions that operators implement for system stability and resource management purposes.
The technical mechanism behind this vulnerability involves the improper handling of cache management within the Connect CA roots endpoint. When remote callers submit requests to this endpoint, the system fails to adequately validate or limit the number of entries added to the cache structure. This allows malicious actors to repeatedly inject new certificate authority roots into the cache without triggering the expected bounds checking mechanisms that should prevent unbounded growth. The vulnerability specifically targets the cache management logic that should enforce operational constraints defined by administrators through configuration parameters.
From an operational impact perspective, this vulnerability creates significant risks for systems relying on Consul's service mesh functionality. The uncontrolled cache expansion can lead to substantial memory consumption increases, potentially causing system instability, performance degradation, or complete service outages. Operators who have configured cache-disable settings or specific resource limits may find their protections rendered ineffective, as the attacker can bypass these controls through carefully crafted requests to the vulnerable endpoint. This undermines the fundamental security and operational integrity of Consul-based service meshes.
The vulnerability aligns with CWE-400, which categorizes uncontrolled resource consumption as a common weakness in software systems. From an adversarial perspective, this flaw maps to ATT&CK technique T1499.001, representing resource exhaustion attacks that target system resources through manipulation of cache or memory structures. The issue particularly affects environments where Consul serves as a critical infrastructure component for service discovery and secure communication between microservices, making it an attractive target for attackers seeking to disrupt service availability.
Organizations should immediately implement mitigations by upgrading to the fixed versions of Consul: 2.0.3 for Community Edition and the corresponding Enterprise versions 1.21.17, 1.22.11, and 2.0.3. These releases contain proper bounds checking mechanisms that prevent uncontrolled cache expansion while maintaining the legitimate functionality of the Connect CA roots endpoint. Security teams should also consider implementing network-level restrictions or rate limiting for requests to the affected endpoint as additional protective measures until full upgrades are completed. The fix addresses both the immediate resource consumption issue and restores proper enforcement of operator-defined cache configurations.