Advisoriesby IbisConsulGHSA-qh7p-pfq3-677h
Consul event endpoint is vulnerable to denial of service
Fix: upgrade to 1.22.0 or later
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | < 1.22.0 | 1.22.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- BIT-consul-2025-11375, CVE-2025-11375, GO-2025-4082
- nvd.nist.gov/vuln/detail/CVE-2025-11375
- github.com/hashicorp/consul/pull/22836
- github.com/hashicorp/consul/commit/e794201d0c618333d81ad775270f7b32801178fb
- discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723
- github.com/hashicorp/consul
- github.com/hashicorp/consul/releases/tag/v1.22.0
- pkg.go.dev/vuln/GO-2025-4082
More Consul advisories
All Consul
Consul is vulnerable to arbitrary file read when configured with Kubernetes authenticationCVE-2026-2808fixed in 1.18.21 +2Consul key/value endpoint is vulnerable to denial of serviceCVE-2025-11374fixed in 1.22.0Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerabilityCVE-2024-10006fixed in 1.20.1Hashicorp Consul Cross-site Scripting vulnerabilityCVE-2024-10086fixed in 1.20.0Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2