AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-q6h7-4qgw-2j9p

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Consul

CVE-2022-29153 · Published Apr 20, 2022 · updated Sep 10, 2026

High7.5
Fix: upgrade to 1.9.17 or later (3 fixed versions below)
GitHub advisory

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
< 1.9.171.9.17
>= 1.10.0, < 1.10.101.10.10
>= 1.11.0, < 1.11.51.11.5
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
BIT-consul-2022-29153, CVE-2022-29153, GO-2022-0615

More Consul advisories

All Consul
Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4High 8.1May 13, 2022HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Medium 5.3Feb 15, 2022Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1