CVE-2026-19113: HashiCorp Consul DoS Vulnerability

CVE-2026-19113 Overview

CVE-2026-19113 is an unauthenticated denial of service vulnerability affecting HashiCorp Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2. Several agent HTTP API endpoints allocate substantial memory before validating and rejecting a request. A remote unauthenticated caller can send crafted requests that force the Consul agent to consume large amounts of memory, degrading availability of the service mesh and configuration plane. The issue is tracked under [CWE-400] Uncontrolled Resource Consumption and is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. HashiCorp published the fix in advisory HCSEC-2026-25.

Critical Impact
Remote unauthenticated attackers can exhaust agent memory through HTTP API requests, disrupting Consul-backed service discovery, health checking, and configuration distribution.

Affected Products

HashiCorp Consul Community Edition 1.3.0 through 2.0.2
HashiCorp Consul Enterprise 1.3.0 through 2.0.2
Consul agents exposing HTTP API endpoints to untrusted networks

Discovery Timeline

2026-08-07 - CVE-2026-19113 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-19113

Vulnerability Analysis

The Consul agent exposes an HTTP API used by clients, operators, and sidecar integrations. Several endpoints read and parse request payloads or query parameters before enforcing size, type, or authorization constraints. An attacker can send requests that cause the agent to allocate large in-memory structures before the request is rejected.

Because the allocation happens prior to validation, the attacker does not need credentials or an ACL token. Repeated requests amplify memory pressure on the agent process, and can trigger swapping, out-of-memory kills, or cascading failures across a Consul cluster. Impact is limited to availability; confidentiality and integrity are not affected.

Root Cause

The vulnerability stems from missing or late input-size enforcement on several agent HTTP API handlers. Request bodies and parameters are consumed and materialized into memory structures before the handler determines that the request is invalid or unauthorized. The condition maps to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

Exploitation requires network access to the Consul agent HTTP API, typically on port 8500 or 8501. No authentication, ACL token, or user interaction is required. An attacker sends HTTP requests to the affected endpoints with payloads or parameters that trigger large memory allocations. HashiCorp advisory HCSEC-2026-25 identifies the affected endpoints and the fixed builds.

No verified public exploit code is available at this time. Refer to the HashiCorp Security Advisory HCSEC-2026-25 for endpoint-level technical detail.

Detection Methods for CVE-2026-19113

Indicators of Compromise

Consul agent processes showing sustained high resident memory or repeated out-of-memory restarts
HTTP access logs containing bursts of requests to agent API endpoints from unauthenticated sources
Requests to /v1/ agent API paths with unusually large Content-Length values or oversized query parameters
Cluster events showing agent flapping, leader elections, or Raft instability correlated with API traffic spikes

Detection Strategies

Enable and centralize Consul audit logging and HTTP access logs, then alert on high request rates to agent API endpoints from sources outside the expected client set.
Baseline normal request body sizes per endpoint and alert on outliers, particularly for endpoints identified in HCSEC-2026-25.
Correlate agent memory metrics (consul.runtime.alloc_bytes, consul.runtime.sys_bytes) with HTTP request patterns to identify allocation spikes.

Monitoring Recommendations

Scrape Consul telemetry through Prometheus or a comparable collector and alert on rapid growth in agent heap usage.
Monitor operating-system OOM killer events on Consul server and client hosts.
Track TCP connection counts and request rates on ports 8500 and 8501 at the network layer.

How to Mitigate CVE-2026-19113

Immediate Actions Required

Upgrade Consul Community Edition to 2.0.3 and Consul Enterprise to 1.21.17, 1.22.11, or 2.0.3 as appropriate for your release train.
Restrict network exposure of the Consul HTTP API to trusted management networks using firewalls, security groups, or service mesh policy.
Enforce ACLs with a default-deny policy so that anonymous callers cannot reach agent endpoints, even though the flaw itself is pre-authorization.
Rate-limit inbound HTTP requests to the Consul agent at a reverse proxy or load balancer.

Patch Information

HashiCorp fixed CVE-2026-19113 in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Details and download links are published in HashiCorp Security Advisory HCSEC-2026-25.

Workarounds

Bind the Consul HTTP API to loopback or a private interface using the addresses.http configuration and disable public listeners.
Place the Consul API behind an authenticating reverse proxy that enforces maximum request body size and per-client rate limits.
Disable unused API endpoints where feasible and require mTLS for agent communication.

bash

# Configuration example: restrict Consul HTTP API to loopback and cap request size at a reverse proxy
# /etc/consul.d/consul.hcl
addresses = {
  http  = "127.0.0.1"
  https = "10.0.0.10"
}
ports = {
  http  = 8500
  https = 8501
}
acl = {
  enabled        = true
  default_policy = "deny"
  enable_token_persistence = true
}

# nginx reverse proxy in front of Consul HTTPS API
# /etc/nginx/conf.d/consul.conf
server {
  listen 443 ssl;
  client_max_body_size 512k;
  limit_req zone=consul_api burst=20 nodelay;
  location /v1/ {
    proxy_pass https://127.0.0.1:8501;
  }
}