CVE-2026-19014
published 2026-08-07CVE-2026-19014: Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization…
PriorityP423medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.36%
28.5th percentile
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.17.0 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.17.0 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
consul: Consul: Denial of Service via uncontrolled resource consumption in Connect authorization endpoint
vendor_redhat·2026-08-07·CVSS 4.3
CVE-2026-19014 [MEDIUM] CWE-770 consul: Consul: Denial of Service via uncontrolled resource consumption in Connect authorization endpoint
consul: Consul: Denial of Service via uncontrolled resource consumption in Connect authorization endpoint
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. A remote attacker could exploit an uncontrolled resource consumption vulnerability in the Connect authorization endpoint. This flaw allows a caller to continuously grow the agent's intention-match cache, bypassing configured cache limits. The primar
VulDB
HashiCorp Consul/Consul Enterprise Connect Authorization Endpoint resource consumption
vuldb·2026-08-07·CVSS 4.3
CVE-2026-19014 [MEDIUM] HashiCorp Consul/Consul Enterprise Connect Authorization Endpoint resource consumption
A vulnerability classified as problematic was found in HashiCorp Consul and Consul Enterprise. The impacted element is an unknown function of the component Connect Authorization Endpoint. Such manipulation leads to resource consumption.
This vulnerability is documented as CVE-2026-19014. The attack can be executed remotely. There is not any exploit available.
GHSA
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow t
ghsa_unreviewed·2026-08-07
CVE-2026-19014 [MEDIUM] CWE-770 Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow t
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
No detection rules found.
No public exploits indexed.
2026-08-07
Published