CVE-2026-19015: HashiCorp Consul DoS Vulnerability

CVE-2026-19015 Overview

CVE-2026-19015 is an uncontrolled resource consumption vulnerability [CWE-770] in HashiCorp Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2. The flaw resides in the Connect Certificate Authority (CA) roots endpoint. A remote, unauthenticated caller can repeatedly query the endpoint to grow the agent's Connect CA roots cache without bound. The behavior defeats the operator's cache-disable configuration and can degrade agent availability over time. HashiCorp addressed the issue in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Critical Impact
A network-adjacent attacker can exhaust memory on Consul agents by driving unbounded cache growth through the Connect CA roots endpoint, impacting service mesh availability.

Affected Products

HashiCorp Consul Community Edition 1.2.0 through 2.0.2
HashiCorp Consul Enterprise 1.2.0 through 1.21.16, 1.22.0 through 1.22.10
HashiCorp Consul Enterprise 2.0.0 through 2.0.2

Discovery Timeline

2026-08-07 - CVE-2026-19015 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19015

Vulnerability Analysis

Consul's Connect service mesh exposes a CA roots endpoint that returns the trust bundle used by proxies to validate mTLS connections. The agent maintains a client-side cache of CA roots to reduce load on the servers. In affected versions, the cache entries accumulate for each unique query variation processed through the endpoint. The accumulation continues even when operators explicitly disable caching in agent configuration.

A remote caller reaching the HTTP API can trigger repeated cache insertions and drive memory consumption on the agent process. Because the vulnerability affects only availability, confidentiality and integrity of service mesh data are not directly at risk. Sustained exploitation, however, can cause the agent to consume excess memory, degrade mesh operations, or crash under memory pressure.

Root Cause

The root cause is missing enforcement of resource limits on the Connect CA roots cache and improper handling of the cache-disable configuration setting [CWE-770]. Cache entries were not bounded and the disable flag was not honored consistently within the code path serving the CA roots endpoint.

Attack Vector

The vulnerability is exploitable over the network with low attack complexity and requires no privileges or user interaction. An attacker with reachability to a Consul agent's HTTP API sends repeated requests to the Connect CA roots endpoint. Each request contributes to unbounded cache growth on the target agent. See the HashiCorp Security Advisory HCSEC-2026-25 for vendor technical details.

Detection Methods for CVE-2026-19015

Indicators of Compromise

Sustained growth of resident memory (RSS) in the consul agent process without corresponding growth in services, nodes, or catalog entries.
Elevated request rates to the /v1/agent/connect/ca/roots or /v1/connect/ca/roots HTTP API endpoints from a single client or small set of clients.
Consul agent restarts or OOMKilled events on hosts running affected versions.

Detection Strategies

Baseline normal request volumes to Consul HTTP API endpoints and alert on anomalous spikes targeting CA roots paths.
Correlate Consul telemetry metrics such as consul.cache.entries_count and consul.runtime.alloc_bytes against request logs to identify unbounded cache growth.
Inspect access logs from reverse proxies or service mesh ingress in front of Consul agents for repeated identical or near-identical requests to CA roots endpoints.

Monitoring Recommendations

Enable Consul telemetry export to a metrics backend and set thresholds on agent memory utilization and cache entry counts.
Forward Consul audit and HTTP API logs to a centralized SIEM for correlation with host-level memory alerts.
Track version inventory of Consul deployments across environments to identify agents still on vulnerable releases.

How to Mitigate CVE-2026-19015

Immediate Actions Required

Upgrade Consul Community Edition to 2.0.3 or later.
Upgrade Consul Enterprise to 1.21.17, 1.22.11, 2.0.3, or later on the corresponding release line.
Restrict network access to Consul agent HTTP API ports (8500/8501) to trusted management networks and service mesh participants only.

Patch Information

HashiCorp released fixes in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Details are published in HashiCorp Security Advisory HCSEC-2026-25. Apply the patch on both servers and clients across the datacenter, following HashiCorp's documented upgrade procedure to preserve raft state and service registrations.

Workarounds

Place Consul HTTP API endpoints behind network access control lists that limit callers to authorized services and operators.
Enable ACLs on Consul and require tokens for API access to reduce the pool of clients able to reach the CA roots endpoint.
Configure host-level or container-level memory limits and automated restart policies to contain impact until patching is complete.

bash

# Verify installed Consul version on each agent
consul version

# Example: restrict HTTP API to loopback and management CIDR via agent config
# /etc/consul.d/consul.hcl
addresses = {
  http = "127.0.0.1 10.20.0.0/24"
}

# Require ACL tokens for API access
acl = {
  enabled        = true
  default_policy = "deny"
  enable_token_persistence = true
}