AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-15972

HashiCorp Consul: denial of service

HashiCorp

CVE-2026-15972 · Published Aug 7, 2026 · updated Aug 28, 2026

High7.5
Fix: upgrade to 2.0.3 or later (2 fixed versions below)
HashiCorp advisory

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected versions

PackageAffectedFixed in
Consul
Product
>= 1.13.0, < 2.0.32.0.3
Consul Enterprise
Product
>= 1.13.0, < 2.0.32.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More HashiCorp advisories

All HashiCorp
Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19012fixed in 2.0.3 +1Medium 4.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19014fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19015fixed in 2.0.3 +1Medium 4.2Aug 7HashiCorp Consul: path traversalCVE-2026-19016fixed in 2.0.3 +1Medium 6.8Aug 7HashiCorp Consul: arbitrary file readCVE-2026-19017fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19113fixed in 2.0.3 +1