CVE-2025-11375CWE-770denial-of-service

CVE-2025-11375

Medium · published October 29, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-10-29T01:15Z
Affected products (4)
ProductVersionsFixed in
hashicorp/consul< 1.18.121.18.12
hashicorp/consul< 1.22.01.22.0
hashicorp/consul≥ 1.19.0, < 1.20.81.20.8
hashicorp/consul≥ 1.21.0, < 1.21.61.21.6
References (1)
https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723 · [email protected]
EPSS history
Timeline
  • 28 OCT 20:12Z
    Consul's event endpoint is vulnerable to denial of service
    cvelistv5