CVE-2026-15972
published 2026-08-07CVE-2026-15972: Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
45.2th percentile
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| hashicorp | consul | >= 1.13.0 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.13.0 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HashiCorp Consul/Consul Enterprise gRPC Listener resource consumption
vuldb·2026-08-07·CVSS 7.5
CVE-2026-15972 [HIGH] HashiCorp Consul/Consul Enterprise gRPC Listener resource consumption
A vulnerability, which was classified as problematic, was found in HashiCorp Consul and Consul Enterprise. This impacts an unknown function of the component gRPC Listener. Executing a manipulation can lead to resource consumption.
This vulnerability appears as CVE-2026-15972. The attack may be performed from remote. There is no available exploit.
GHSA
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners.
ghsa_unreviewed·2026-08-07·CVSS 7.5
CVE-2026-15972 [HIGH] CWE-770 Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners.
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Red Hat
consul: consul-enterprise: Consul: Denial of Service via unbounded external gRPC connection acceptance
vendor_redhat·2026-08-07·CVSS 7.5
CVE-2026-15972 [HIGH] CWE-770 consul: consul-enterprise: Consul: Denial of Service via unbounded external gRPC connection acceptance
consul: consul-enterprise: Consul: Denial of Service via unbounded external gRPC connection acceptance
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. A remote attacker can exploit this vulnerability by sending numerous incomplete connection requests to the external gRPC (gRPC Remote Procedure Call) listeners. This unbounded connecti
No detection rules found.
No public exploits indexed.
2026-08-07
Published