CVE-2026-19014
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 causes uncontrolled resource consumption in the Connect authorization endpoint. This allows an attacker to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. The issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Risk Assessment
The risk is resource exhaustion on the server, potentially leading to denial of service and disruption of infrastructure operations.
Recommendation
Upgrade Consul to version 2.0.3 or later (for Enterprise to the specified versions) as soon as possible and monitor memory usage.
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.