CVE-2026-19113
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This is fixed in Consul 2.0.3 and corresponding Enterprise versions.
Risk Assessment
An attacker could cause memory exhaustion on the Consul agent, leading to service unavailability and disruption of infrastructure.
Recommendation
Upgrade Consul to version 2.0.3 (Community) or the appropriate Enterprise version (1.21.17, 1.22.11, 2.0.3).
Original NVD description (English source)
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.