Threat Investigation
Request a demo

CVE-2026-19113

Medium

Description

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

SeverityMedium
CVSS5.3
Exploit probability—
ProductConsul
PublishedAug 7, 2026
First seenAug 7, 2026
Weakness typeCWE-400Uncontrolled resource consumption

How to fix

Update
  • HashiCorp Consul2.0.3 or later
  • HashiCorp Consul Enterprise2.0.3 or later

Affected products

ProductAffected versionsFixed in
HashiCorp Consul1.3.0 ≤ v < 2.0.32.0.3
HashiCorp Consul Enterprise1.3.0 ≤ v < 2.0.32.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.