AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

HashiCorpCVE-2026-19113

HashiCorp Consul: denial of service

HashiCorp

CVE-2026-19113 · Published Aug 7, 2026 · updated Aug 28, 2026

Medium5.3
Fix: upgrade to 2.0.3 or later (2 fixed versions below)
HashiCorp advisory

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected versions

PackageAffectedFixed in
Consul
Product
>= 1.3.0, < 2.0.32.0.3
Consul Enterprise
Product
>= 1.3.0, < 2.0.32.0.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-400

More HashiCorp advisories

All HashiCorp
High 7.5Aug 7HashiCorp Consul: denial of serviceCVE-2026-15972fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: denial of serviceCVE-2026-19012fixed in 2.0.3 +1Medium 4.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19014fixed in 2.0.3 +1Medium 5.3Aug 7HashiCorp Consul: resource exhaustionCVE-2026-19015fixed in 2.0.3 +1Medium 4.2Aug 7HashiCorp Consul: path traversalCVE-2026-19016fixed in 2.0.3 +1Medium 6.8Aug 7HashiCorp Consul: arbitrary file readCVE-2026-19017fixed in 2.0.3 +1