HCSEC-2026-48 - Consul vulnerable to a denial of service in HTTP APIs

Bulletin ID: HCSEC-2026-48 Affected Products / Versions: Consul and Consul Enterprise up to 2.0.4; fixed in Consul 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19 Publication Date: October 26, 2026 Summary HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. Background Consul client and server agents expose an HTTP API for operations such as registering services and managing configuration. Requests are authorized with ACL tokens, and for many write operations the caller’s permissions are evaluated after the request has been received and processed by the agent. Details Several Consul HTTP API endpoints read and decoded the entire request body into memory without a size limit before the caller’s ACL permissions were evaluated. An attacker with network access to an agent’s HTTP API could send very large request bodies, including to endpoints that do not require authentication, causing excessive memory consumption. Large or concurrent requests could degrade the agent or cause the operating system to terminate it, resulting in a denial of service. The issue requires network access to the HTTP API but does not require a valid ACL token. Remediation Customers should evaluate the risk associated with this issue and consider upgrading to Consul Community Edition 2.1.0 or Consul Enterprise 2.1.0 or 1.21.19. After upgrading, most HTTP API write endpoints reject request bodies larger than 512 KiB, so operators who submit unusually large payloads, such as large configuration entries, should confirm their requests stay within this limit. Acknowledgement This issue was reported to HashiCorp by Immad Sahin of ZeroTrail. We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at Has…