CVE-2026-19113CWE-400denial-of-service

CVE-2026-19113

Medium · published August 8, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-08T00:16Z
References (1)
https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629 · [email protected]
EPSS history
Timeline
  • 07 AUG 19:20Z
    Unauthenticated denial of service via unbounded request body processing
    cvelistv5