CVE-2026-19015
published 2026-08-07CVE-2026-19015: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.40%
33.3th percentile
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.2.0 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.2.0 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
consul: Consul: Uncontrolled resource consumption leading to denial of service
vendor_redhat·2026-08-07·CVSS 5.3
CVE-2026-19015 [MEDIUM] CWE-770 consul: Consul: Uncontrolled resource consumption leading to denial of service
consul: Consul: Uncontrolled resource consumption leading to denial of service
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. A remote attacker can exploit an uncontrolled resource consumption vulnerability in the Connect CA roots endpoint. This allows the attacker to continuously grow the agent's Connect CA roots cache, bypassing configured cache limits. The consequence is a denial of service (DoS
GHSA
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow
ghsa_unreviewed·2026-08-07·CVSS 5.3
CVE-2026-19015 [MEDIUM] CWE-770 Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
VulDB
HashiCorp Consul Connect CA Roots Endpoint resource consumption
vuldb·2026-08-07·CVSS 5.3
CVE-2026-19015 [MEDIUM] HashiCorp Consul Connect CA Roots Endpoint resource consumption
A vulnerability described as problematic has been identified in HashiCorp Consul. Impacted is an unknown function of the component Connect CA Roots Endpoint. The manipulation results in resource consumption.
This vulnerability is cataloged as CVE-2026-19015. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
2026-08-07
Published