CVE-2026-19113 HashiCorp CVE debrief

Who should care

Administrators and security teams responsible for Consul instances, particularly those using versions 1.3.0 through 2.0.2, should review and update their configurations. This includes operators managing Consul clusters, security teams monitoring for potential denial of service attacks, and platform teams ensuring that Consul instances are properly secured and updated. Additionally, vulnerability management teams should prioritize patching or mitigating this vulnerability to prevent potential service disruptions.

Technical summary

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. The vulnerability impacts Consul instances using affected versions, particularly those with publicly exposed agent HTTP API endpoints.

Defensive priority

Medium-priority defensive review recommended due to potential denial of service impact.

Recommended defensive actions

• Review Consul instance configurations and update to version 2.0.3 or later
• Implement compensating controls to detect and prevent excessive memory consumption
• Monitor Consul agent HTTP API endpoints for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicates a denial of service vulnerability in Consul Community Edition and Consul Enterprise. Limited detail available on exploitability and affected scope. Defenders should verify Consul instance configurations, review agent HTTP API endpoints for suspicious activity, and monitor for excessive memory consumption.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.