CVE-2026-19014CWE-770denial-of-service

CVE-2026-19014

Medium · published August 8, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
28.5
In the wild
Unconfirmed
What it is

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-08T00:16Z
References (1)
https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629 · [email protected]
EPSS history
Timeline
  • 07 AUG 19:19Z
    Uncontrolled resource consumption in the Consul Connect authorization endpoint
    cvelistv5