Advisoriesby IbisConsulGHSA-5c4w-8hhh-3c3h
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability
Fix: upgrade to 1.20.1 or later
A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.9.0, < 1.20.1 | 1.20.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-116, CWE-644
- Also known as
- BIT-consul-2024-10006, CVE-2024-10006, GO-2024-3241
- nvd.nist.gov/vuln/detail/CVE-2024-10006
- github.com/hashicorp/consul/pull/21816
- github.com/hashicorp/consul/commit/d9206fc7e284a9244af4d62f8653a63ca30bd00c
- discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass
- github.com/hashicorp/consul
- security.netapp.com/advisory/ntap-20250110-0005
More Consul advisories
All Consul
Consul event endpoint is vulnerable to denial of serviceCVE-2025-11375fixed in 1.22.0Consul key/value endpoint is vulnerable to denial of serviceCVE-2025-11374fixed in 1.22.0Hashicorp Consul Cross-site Scripting vulnerabilityCVE-2024-10086fixed in 1.20.0Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1