CVE-2025-11374 Overview
CVE-2025-11374 is a denial of service (DoS) vulnerability in HashiCorp Consul and Consul Enterprise. The flaw resides in the key/value (KV) HTTP API endpoint, which incorrectly validates the Content-Length header on incoming requests. An authenticated attacker with low privileges can exploit this improper validation to exhaust server resources and disrupt availability of the Consul service. HashiCorp addressed the issue in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8, and 1.18.12. The vulnerability is classified under [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
An authenticated attacker can trigger denial of service against Consul agents and servers by sending crafted requests to the KV endpoint, disrupting service discovery and configuration management for dependent workloads.
Affected Products
- HashiCorp Consul Community Edition prior to 1.22.0
- HashiCorp Consul Enterprise prior to 1.22.0, 1.21.6, 1.20.8, and 1.18.12
- Deployments exposing the Consul HTTP KV API to authenticated clients
Discovery Timeline
- 2025-10-28 - CVE-2025-11374 published to NVD
- 2025-10-28 - HashiCorp publishes advisory HCSEC-2025-29
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11374
Vulnerability Analysis
Consul exposes an HTTP API that includes the /v1/kv/ endpoint for storing and retrieving arbitrary key/value pairs. The endpoint processes client-supplied request bodies to write values into the Consul state store. The vulnerability stems from incorrect validation of the Content-Length header supplied by the client. Because the server does not properly enforce bounds on the declared or actual body size, an authenticated caller can trigger disproportionate resource consumption on the receiving Consul agent or server.
Successful exploitation requires a valid ACL token with write access to at least one KV path, matching the low-privilege authentication requirement in the vulnerability metadata. There is no impact to confidentiality or integrity; the consequence is service unavailability. When Consul serves as the backbone for service discovery, health checking, and dynamic configuration, a KV-driven outage cascades into failures across dependent applications and service meshes.
Root Cause
The root cause is improper enforcement of resource limits on the KV write path, aligning with [CWE-770]. Consul accepts requests where the Content-Length header is not correctly validated against server-side allocation limits, permitting the endpoint to consume memory or processing capacity beyond safe thresholds during request handling.
Attack Vector
The attack is network-based and requires an authenticated client with an ACL token permitting KV writes. An adversary submits crafted HTTP requests to the /v1/kv/ endpoint with manipulated Content-Length headers or oversized payloads. Repeated or concurrent requests exhaust available resources, causing the Consul process to become unresponsive and denying service to legitimate clients. See the HashiCorp Advisory HCSEC-2025-29 for vendor-provided technical details.
Detection Methods for CVE-2025-11374
Indicators of Compromise
- Sudden spikes in memory or CPU utilization on Consul server and agent processes without corresponding legitimate workload changes.
- Elevated volume of HTTP PUT requests to /v1/kv/ paths from a single ACL token or source IP.
- Consul RPC timeouts, leader election churn, or health check flapping across the cluster.
- HTTP requests to the KV endpoint with unusually large or malformed Content-Length header values.
Detection Strategies
- Enable Consul HTTP audit logging and correlate KV write patterns per ACL token to baseline expected behavior.
- Deploy a reverse proxy or web application firewall in front of the Consul HTTP API to inspect and rate-limit requests to /v1/kv/.
- Monitor Consul telemetry metrics such as consul.http, consul.rpc.request, and Go runtime memory statistics for anomalous growth.
Monitoring Recommendations
- Alert on sustained increases in Consul process resident memory or goroutine counts that exceed operational baselines.
- Track the ratio of KV write requests to overall API traffic and flag deviations that suggest abuse.
- Forward Consul access and audit logs into a centralized analytics platform for cross-cluster correlation and retrospective hunting.
How to Mitigate CVE-2025-11374
Immediate Actions Required
- Upgrade to Consul Community Edition 1.22.0 or Consul Enterprise 1.22.0, 1.21.6, 1.20.8, or 1.18.12, matching your current release train.
- Audit issued ACL tokens and revoke or scope down any tokens with unnecessary KV write privileges.
- Restrict network exposure of the Consul HTTP API so that only trusted management networks can reach the KV endpoint.
- Enable rate limiting at the load balancer or reverse proxy layer for the /v1/kv/ path.
Patch Information
HashiCorp resolved CVE-2025-11374 by correcting Content-Length validation on the KV endpoint. Fixed releases are Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8, and 1.18.12. Detailed remediation guidance is available in the HashiCorp Advisory HCSEC-2025-29.
Workarounds
- Configure Consul ACLs with a default-deny policy and grant KV write access only to specific service identities that require it.
- Enforce request size limits on the Consul HTTP API through an upstream proxy such as Envoy or NGINX.
- Isolate Consul cluster network access using firewall rules or service mesh policies until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
