HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs
// AI summary
HashiCorp Consul and Consul Enterprise up to 2.0.4 are vulnerable to CVE-2026-105626, a denial of service in the HTTP API allowing an unauthenticated attacker to exhaust memory.
// from the source
Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Ba