CVE-2026-15972: HashiCorp Consul DoS Vulnerability

CVE-2026-15972 Overview

CVE-2026-15972 is an unauthenticated denial of service vulnerability affecting HashiCorp Consul Community Edition and Consul Enterprise versions 1.13.0 through 2.0.2. The flaw resides in the external gRPC listeners, which accept connections without bounds. A remote attacker can open many incomplete connections to exhaust agent file descriptors, goroutines, and memory. Legitimate clients are then blocked from establishing new connections to the Consul agent. HashiCorp addressed the issue in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. The vulnerability is classified under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Unauthenticated remote attackers can render Consul agents unresponsive by exhausting resources through unbounded gRPC connection acceptance.

Affected Products

HashiCorp Consul Community Edition 1.13.0 through 2.0.2
HashiCorp Consul Enterprise 1.13.0 through 2.0.2
Any service mesh or service discovery deployment relying on affected Consul agents with exposed external gRPC listeners

Discovery Timeline

2026-08-07 - CVE-2026-15972 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-15972

Vulnerability Analysis

The vulnerability stems from missing limits on connection acceptance in Consul's external gRPC listener. Consul agents accept inbound gRPC connections used for service mesh xDS distribution and other control plane operations. The listener does not cap the number of concurrent connections or enforce timeouts on incomplete handshakes.

An attacker on the network can open a large volume of TCP connections and either delay or omit the completion of the gRPC handshake. Each connection consumes a file descriptor, allocates goroutines within the Go runtime, and holds memory buffers. Once these resources are exhausted, the agent cannot service legitimate clients.

The impact affects availability only. Confidentiality and integrity are not directly affected, but service mesh outages can cascade into dependent workload failures.

Root Cause

The root cause is [CWE-770: Allocation of Resources Without Limits or Throttling]. The external gRPC listener lacks bounds on connection count, handshake timeouts, and per-source rate limits. Incomplete connections persist until operating system limits force failures.

Attack Vector

The attack requires only network reachability to the Consul agent's external gRPC port. No authentication or user interaction is needed. An attacker scripts a client that repeatedly opens TCP connections to the gRPC listener without progressing the handshake, holding sockets open until file descriptor and memory ceilings are reached. See the HashiCorp Security Advisory HCSEC-2026-25 for vendor detail.

Detection Methods for CVE-2026-15972

Indicators of Compromise

Sudden spikes in the number of half-open or ESTABLISHED TCP connections to the Consul external gRPC port (default 8502 or 8503 for TLS)
Consul agent logs reporting file descriptor exhaustion, goroutine growth, or failures accepting new connections
Elevated memory and goroutine counts observed in Consul telemetry metrics such as consul.runtime.num_goroutines and consul.runtime.alloc_bytes
Legitimate service mesh clients failing xDS reconnections or health check registrations

Detection Strategies

Monitor per-source connection rates to the Consul gRPC listener and alert on anomalous growth from single IPs or subnets
Correlate Consul agent process metrics (open file descriptors, resident memory) with connection counts to identify resource exhaustion patterns
Inspect network flow telemetry for high volumes of short-lived or incomplete TLS handshakes targeting gRPC ports

Monitoring Recommendations

Ingest Consul telemetry and host metrics into a centralized analytics platform to establish baselines for connection volume and runtime resource usage
Alert on Consul log entries indicating accept: too many open files or similar resource pressure conditions
Track availability of dependent services that rely on Consul for discovery and configuration to catch cascading impact early

How to Mitigate CVE-2026-15972

Immediate Actions Required

Upgrade Consul Community Edition to version 2.0.3 or later
Upgrade Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 depending on your current release train
Restrict network access to the external gRPC listener so only trusted service mesh clients can reach ports 8502 and 8503
Review agent file descriptor limits (ulimit -n) and ensure they are appropriately sized for expected load

Patch Information

HashiCorp released fixed builds in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Details are available in the HashiCorp Security Advisory HCSEC-2026-25. Apply the patch across all agents in the cluster, including servers and clients, before re-exposing gRPC endpoints.

Workarounds

Place the Consul gRPC listener behind a network firewall or security group that permits only known service mesh workload IP ranges
Enforce mutual TLS on the gRPC listener and terminate connections that fail to complete handshakes within a short timeout at an upstream proxy
Deploy a rate-limiting reverse proxy in front of the Consul agent to cap concurrent connections per source until patching is complete

bash

# Example: restrict Consul gRPC ports with iptables to trusted subnet only
iptables -A INPUT -p tcp --dport 8502 -s 10.0.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8503 -s 10.0.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8502 -j DROP
iptables -A INPUT -p tcp --dport 8503 -j DROP

# Increase file descriptor limits for the Consul service (systemd unit override)
# /etc/systemd/system/consul.service.d/limits.conf
[Service]
LimitNOFILE=65535