CVE-2026-15972CWE-770denial-of-service

CVE-2026-15972

High · published August 8, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-08T00:16Z
References (1)
https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629 · [email protected]
EPSS history
Timeline
  • 07 AUG 19:20Z
    Unauthenticated denial of service via unbounded external gRPC connection acceptance
    cvelistv5