AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-23jv-v6qj-3fhh

Denial of Service (DoS) in HashiCorp Consul

Consul

CVE-2020-7219 · Published May 18, 2021 · updated Sep 10, 2026

High7.5
Fix: upgrade to 1.6.3 or later
GitHub advisory

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/consul

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
< 1.6.31.6.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-770
Also known as
BIT-consul-2020-7219, CVE-2020-7219, GO-2022-0776

More Consul advisories

All Consul
Medium 5.3Jul 28, 2021Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3High 7.5Jul 19, 2021HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1High 7.5Jul 19, 2021Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Medium 5.3Jun 23, 2021Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1Medium 5.3May 18, 2021Improper Input Validation in HashiCorp ConsulCVE-2020-13170fixed in 1.6.6 +1