Live › vulnerability › CVE-2026-105626
Go to dashboardHashiCorp Consul and Consul Enterprise have a denial-of-service flaw in the HTTP API. An unauthenticated attacker can exhaust memory on a Consul agent, crashing it or degrading service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Any team running Consul or Consul Enterprise agents whose HTTP API is reachable by an attacker. Exposure depends on network reachability of the HTTP API; the sources do not describe a configuration that avoids it. Teams on fixed versions can skip it.
No product ranges from the sources yet.
consul version on each Consul agent and compare against the fixed versions listed in Fix.consul members from outside the cluster network or by checking the bind address in the agent configuration.2.1.0.2.1.0 or 1.21.19.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
This page as .md · .json · in your agent: get_signal("CVE-2026-105626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.