CVE-2026-19014: Consul DoS Vulnerability via Cache Bypass

CVE-2026-19014 Overview

CVE-2026-19014 affects HashiCorp Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2. The Connect authorization endpoint permits an authenticated caller to grow the agent's intention-match cache without bound. This behavior defeats the operator's cache-disable configuration and can lead to resource exhaustion on the affected agent. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. HashiCorp published details in HashiCorp Security Advisory HCSEC-2026-25. Fixes are available in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Critical Impact
An authenticated network caller can exhaust Consul agent memory by populating the intention-match cache, degrading service mesh availability even when operators explicitly disable caching.

Affected Products

Consul Community Edition 1.17.0 through 2.0.2
Consul Enterprise 1.17.0 through 2.0.2
Consul agents exposing the Connect authorization endpoint

Discovery Timeline

2026-08-07 - CVE-2026-19014 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19014

Vulnerability Analysis

Consul's Connect feature provides mutual TLS authentication and authorization between services in a service mesh. Authorization decisions rely on intentions, which define which services may communicate. To accelerate repeated decisions, the agent maintains an intention-match cache keyed by request parameters.

The Connect authorization endpoint accepts caller-supplied inputs that participate in cache key construction. An authenticated caller can vary those inputs across requests to insert new entries into the cache. The endpoint does not enforce an upper bound on cache size, and it does not honor the operator's cache-disable configuration for this code path. Cache growth continues as long as the caller submits distinct requests.

The result is uncontrolled memory growth in the agent process. Sustained exploitation can degrade responsiveness, evict legitimate cache entries, and eventually cause the agent to fail under memory pressure, impacting service mesh availability.

Root Cause

The root cause is missing enforcement of resource limits on the intention-match cache used by the Connect authorization endpoint [CWE-770]. The endpoint bypasses the operator-controlled cache-disable setting, allowing unbounded insertion by any caller with valid credentials to the agent API.

Attack Vector

Exploitation requires network access to the Consul agent API and low-privilege authentication. No user interaction is needed. An attacker issues repeated authorization requests to the Connect endpoint with varied parameters, forcing the agent to allocate cache entries per unique request. Because the vulnerability is a design flaw in cache handling, no memory corruption primitive or code injection is involved.

See HashiCorp Security Advisory HCSEC-2026-25 for vendor-supplied technical details.

Detection Methods for CVE-2026-19014

Indicators of Compromise

Sustained growth in Consul agent resident memory (RSS) without a corresponding increase in registered services or intentions.
High-volume requests to the Connect authorization endpoint originating from a single client or ACL token.
Agent logs showing elevated authorization request rates with widely varying source/destination parameters.

Detection Strategies

Monitor per-token request rates against the Consul HTTP API and alert on anomalous callers hitting Connect authorization paths.
Correlate agent memory metrics with authorization endpoint request volume to identify cache-driven growth patterns.
Inspect access logs for repeated authorization queries with high cardinality in caller-supplied parameters.

Monitoring Recommendations

Export Consul telemetry (consul.runtime.alloc_bytes, consul.cache.*) to a metrics platform and baseline normal cache size.
Alert on ACL tokens exceeding request-rate thresholds against /v1/agent/connect/authorize.
Track agent restart events and out-of-memory conditions across the cluster fleet.

How to Mitigate CVE-2026-19014

Immediate Actions Required

Upgrade Consul Community Edition to 2.0.3.
Upgrade Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 based on your deployed branch.
Audit ACL tokens with access to the Connect authorization endpoint and revoke unused or overly permissive tokens.
Restrict network access to the agent API to trusted service mesh participants.

Patch Information

HashiCorp addressed CVE-2026-19014 in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Refer to HashiCorp Security Advisory HCSEC-2026-25 for release notes and upgrade guidance.

Workarounds

Apply strict ACL policies that limit which tokens can call /v1/agent/connect/authorize.
Place the Consul agent API behind network policies that permit only sidecar proxies and known control-plane clients.
Set process-level memory limits (systemd MemoryMax, cgroup constraints, or Kubernetes resource limits) to contain impact until patching is complete.

bash

# Example: constrain the Consul agent with a systemd memory limit
# /etc/systemd/system/consul.service.d/override.conf
[Service]
MemoryMax=2G
MemoryHigh=1750M

# Reload and restart
sudo systemctl daemon-reload
sudo systemctl restart consul