CVE-2026-19113 in Consul
Summary
by MITRE • 08/07/2026
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified as CVE-2026-19113 represents a critical denial of service weakness affecting HashiCorp Consul Community Edition and Enterprise versions ranging from 1.3.0 through 2.0.2. This flaw specifically targets the agent's HTTP API endpoints, creating a scenario where unauthenticated remote attackers can exploit the system by crafting malicious requests that cause excessive memory consumption. The vulnerability operates at the application layer and demonstrates how seemingly benign API interactions can be weaponized to exhaust system resources without proper authentication checks.
The technical implementation of this vulnerability stems from inadequate input validation and resource management within the Consul agent's HTTP handling mechanisms. When remote callers submit crafted requests to affected endpoints, the system processes these inputs without sufficient rate limiting or memory allocation controls, leading to unbounded memory growth. The flaw allows attackers to consume substantial system resources before the request is ultimately rejected, effectively creating a resource exhaustion condition that can render the Consul agent unavailable to legitimate users. This type of vulnerability aligns with CWE-400 which categorizes improper resource management and CWE-770 which addresses allocation of resources without limits or proper checks.
The operational impact of this vulnerability extends beyond simple service disruption, as it can compromise the overall stability and availability of distributed systems relying on Consul for service discovery and configuration management. Organizations using affected Consul versions face potential cascading failures where a single malicious request can cause agent processes to consume all available memory, leading to system crashes or forced restarts. This vulnerability particularly affects environments where Consul agents are exposed to untrusted networks or where proper firewall rules are not implemented to restrict access to sensitive endpoints. The attack vector requires no authentication credentials, making it especially dangerous in deployments where security boundaries may be weak or improperly configured.
Security professionals should prioritize immediate remediation of this vulnerability by upgrading to the patched versions including Consul 2.0.3 and Consul Enterprise versions 1.21.17, 1.22.11, and 2.0.3. The ATT&CK framework categorizes this as a resource exhaustion technique under the T1499 subtechnique for network denial of service attacks. Organizations should implement network segmentation to limit access to Consul agent endpoints, deploy monitoring solutions to detect unusual memory consumption patterns, and establish automated alerting for resource usage anomalies. Additionally, implementing proper access controls through ACLs and ensuring that Consul agents are not directly exposed to untrusted networks provides defense-in-depth measures against exploitation of this vulnerability. The fix addresses the root cause by introducing proper input validation, memory allocation limits, and rate limiting mechanisms within the HTTP API processing pipeline to prevent malicious requests from consuming excessive resources.