CVE-2026-19015
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration.
Risk Assessment
An attacker could cause uncontrolled memory growth, leading to resource exhaustion and denial of service.
Recommendation
Upgrade Consul to version 2.0.3 (Community) or the appropriate Enterprise version (1.21.17, 1.22.11, 2.0.3).
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.