CVE-2025-11375: HashiCorp Consul Event Endpoint DoS Vulnerability

CVE-2025-11375 Overview

HashiCorp Consul and Consul Enterprise contain a denial of service vulnerability in the event endpoint. The endpoint fails to enforce a maximum value on the HTTP Content-Length header, allowing authenticated attackers to submit oversized requests that exhaust server resources. The flaw is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

HashiCorp published the issue in security advisory HCSEC-2025-28 and released fixed builds in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8, and 1.18.12. The vulnerability affects service discovery and configuration workloads that rely on Consul's HTTP API.

Critical Impact
An authenticated attacker with network access to the event endpoint can trigger denial of service against Consul servers, disrupting service mesh and configuration operations across the cluster.

Affected Products

HashiCorp Consul Community Edition prior to 1.22.0
HashiCorp Consul Enterprise prior to 1.22.0, 1.21.6, 1.20.8, and 1.18.12
Deployments exposing the Consul HTTP API event endpoint

Discovery Timeline

2025-10-28 - CVE-2025-11375 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11375

Vulnerability Analysis

Consul exposes an event endpoint through its HTTP API that lets clients fire custom user events across the cluster. The endpoint accepts request bodies without validating an upper bound on the Content-Length header. An authenticated caller can send a request declaring a large payload, and Consul attempts to allocate memory proportional to that value.

Repeated oversized requests exhaust available memory or processing capacity on the target Consul agent. This condition renders the server unresponsive to legitimate service discovery, health check, and key-value store operations. In clustered deployments, disruption to server agents can degrade the entire service mesh control plane.

The underlying weakness maps to [CWE-770], where the application allocates resources based on attacker-controlled input without applying throttling or size limits. See the HashiCorp Security Advisory HCSEC-2025-28 for vendor-provided technical detail.

Root Cause

The event endpoint handler does not enforce a maximum payload size before accepting request bodies. Missing input validation on the Content-Length header allows arbitrarily large allocations, creating a resource exhaustion condition on the receiving Consul agent.

Attack Vector

Exploitation requires network access to a Consul agent's HTTP API and valid credentials with permission to publish events. The attacker sends crafted HTTP requests to the event endpoint with inflated Content-Length values or oversized bodies. No user interaction is required, and the attack succeeds over the network against default configurations.

Refer to the HashiCorp Security Advisory HCSEC-2025-28 for vendor guidance. No public proof-of-concept code was available at the time of publication.

Detection Methods for CVE-2025-11375

Indicators of Compromise

HTTP requests to /v1/event/fire/* with unusually large Content-Length headers
Sudden memory pressure, out-of-memory events, or crash logs on Consul server agents
Loss of quorum or leader elections coinciding with spikes in HTTP API traffic
Repeated event fire requests from a single ACL token or client IP

Detection Strategies

Enable Consul HTTP audit logging and forward events to a centralized SIEM for correlation
Alert on POST requests to the event endpoint that exceed a baseline body size
Correlate Consul agent resource metrics with HTTP API request patterns to surface abusive callers
Monitor ACL token usage for anomalous event firing behavior tied to service accounts

Monitoring Recommendations

Track Consul agent memory, goroutine count, and request latency through the telemetry endpoint
Set threshold alerts on 5xx responses from /v1/event/fire/* handlers
Review reverse proxy or load balancer logs for oversized request bodies destined for Consul

How to Mitigate CVE-2025-11375

Immediate Actions Required

Upgrade to Consul Community Edition 1.22.0 or Consul Enterprise 1.22.0, 1.21.6, 1.20.8, or 1.18.12
Restrict network exposure of the Consul HTTP API to trusted management networks
Audit ACL policies and remove event:write permissions from tokens that do not require them
Rotate ACL tokens with broad event permissions after patching

Patch Information

HashiCorp addressed CVE-2025-11375 in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8, and 1.18.12. Upgrade instructions and release notes are available in HashiCorp Security Advisory HCSEC-2025-28.

Workarounds

Place a reverse proxy in front of Consul and enforce a maximum request body size on /v1/event/fire/*
Apply ACL policies that deny event:write for all tokens except those explicitly required
Segment the Consul HTTP API onto a management VLAN reachable only by trusted operators
Rate-limit inbound requests to the Consul HTTP API at the network or proxy layer

bash

# Example NGINX reverse proxy limit protecting the Consul event endpoint
location /v1/event/ {
    client_max_body_size 64k;
    limit_req zone=consul_api burst=5 nodelay;
    proxy_pass http://consul_backend;
}