AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-19015

HashiCorp Consul: resource exhaustion

HashiCorp

CVE-2026-19015 · Published Aug 7, 2026 · updated Aug 28, 2026

Medium5.3
Fix: upgrade to 2.0.3 or later (2 fixed versions below)
HashiCorp advisory

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected versions

PackageAffectedFixed in
Consul
Product
>= 1.2.0, < 2.0.32.0.3
Consul Enterprise
Product
>= 1.2.0, < 2.0.32.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-770

More HashiCorp advisories

All HashiCorp
High 7.5Aug 7HashiCorp Consul: denial of serviceCVE-2026-15972fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19012fixed in 2.0.3 +1Medium 4.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19014fixed in 2.0.3 +1Medium 4.2Aug 7HashiCorp Consul: path traversalCVE-2026-19016fixed in 2.0.3 +1Medium 6.8Aug 7HashiCorp Consul: arbitrary file readCVE-2026-19017fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19113fixed in 2.0.3 +1