CVE-2026-19113
published 2026-08-07CVE-2026-19113: Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.40%
33.3th percentile
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | consul | >= 1.3.0 < 2.0.3 | 2.0.3 |
| hashicorp | consul_enterprise | >= 1.3.0 < 2.0.3 | 2.0.3 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HashiCorp Consul/Consul Enterprise up to 2.0.2 HTTP API Endpoint resource consumption
vuldb·2026-08-07·CVSS 5.3
CVE-2026-19113 [MEDIUM] HashiCorp Consul/Consul Enterprise up to 2.0.2 HTTP API Endpoint resource consumption
A vulnerability was found in HashiCorp Consul and Consul Enterprise up to 2.0.2. It has been classified as problematic. Affected by this issue is some unknown functionality of the component HTTP API Endpoint. This manipulation causes resource consumption.
This vulnerability is handled as CVE-2026-19113. The attack can be initiated remotely. There is not any exploit available.
GHSA
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints.
ghsa_unreviewed·2026-08-07·CVSS 5.3
CVE-2026-19113 [MEDIUM] CWE-400 Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints.
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Red Hat
consul: Consul: Unauthenticated denial of service via unbounded request body processing
vendor_redhat·2026-08-07·CVSS 5.3
CVE-2026-19113 [MEDIUM] CWE-770 consul: Consul: Unauthenticated denial of service via unbounded request body processing
consul: Consul: Unauthenticated denial of service via unbounded request body processing
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A flaw was found in Consul. A remote, unauthenticated attacker could exploit several agent HTTP API endpoints by sending a request with an unbounded body. This could cause the agent to consume substantial memory, leading to a denial of service (DoS) condition.
No detection rules found.
No public exploits indexed.
2026-08-07
Published