CVE-2026-105626

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105626", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2026-10-05T16:33:22.337Z", "datePublished": "2026-10-26T18:02:25.376Z", "dateUpdated": "2026-10-26T19:38:29.471Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul Enterprise", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"changes": [{"at": "1.21.19", "status": "unaffected"}], "lessThan": "2.1.0", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "value": "This issue was reported to HashiCorp by Immad Sahin of ZeroTrail."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.</p><br/>"}], "value": "HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130: Excessive Allocation"}]}], "metrics": [{"cvssV3_1": {"baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-10-26T18:02:25.376Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-48-consul-vulnerable-to-a-denial-of-service-in-http-apis/77913"}], "source": {"advisory": "HCSEC-2026-48", "discovery": "EXTERNAL"}, "title": "Consul vulnerable to a denial of service in HTTP APIs"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T18:59:37.651193Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T19:38:29.471Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-105626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T18:59:37.651193Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T19:30:53.567Z"}}], "cna": {"title": "Consul vulnerable to a denial of service in HTTP APIs", "source": {"advisory": "HCSEC-2026-48", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "This issue was reported to HashiCorp by Immad Sahin of ZeroTrail."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130: Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul", "versions": [{"status": "affected", "version": "0.6.0", "lessThan": "2.1.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul Enterprise", "versions": [{"status": "affected", "changes": [{"at": "1.21.19", "status": "unaffected"}], "version": "0.6.0", "lessThan": "2.1.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-48-consul-vulnerable-to-a-denial-of-service-in-http-apis/77913"}], "descriptions": [{"lang": "en", "value": "HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.", "supportingMedia": [{"type": "text/html", "value": "<p>HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2026-10-26T18:02:25.376Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105626", "state": "PUBLISHED", "dateUpdated": "2026-10-26T19:38:29.471Z", "dateReserved": "2026-10-05T16:33:22.337Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2026-10-26T18:02:25.376Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul Enterprise", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"changes": [{"at": "1.21.19", "status": "unaffected"}], "lessThan": "2.1.0", "status": "affected", "version": "0.6.0", "versionType": "semver"}]}], "source": "security@hashicorp.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19."}], "id": "CVE-2026-105626", "lastModified": "2026-10-26T20:17:39.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@hashicorp.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105626", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T18:59:37.651193Z", "version": "2.0.3"}}]}, "published": "2026-10-26T18:17:27.060", "references": [{"source": "security@hashicorp.com", "url": "https://discuss.hashicorp.com/t/hcsec-2026-48-consul-vulnerable-to-a-denial-of-service-in-http-apis/77913"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security@hashicorp.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/hashicorp/consul: Consul: Denial of Service via memory exhaustion in HTTP API", "id": "2560989", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560989"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.", "A flaw was found in HashiCorp Consul. An unauthenticated remote attacker can exploit this vulnerability through the HTTP Application Programming Interface (API) to cause excessive memory consumption on a Consul agent. Successful exploitation leads to memory exhaustion and results in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enforce request body size limits prior to reading and decoding HTTP API payloads on Consul agents: upgrade to Consul Community Edition 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 (or the fixed Grafana builds), which enforce a 512 KiB request body limit on most write endpoints, closing all 2 injection vectors (excessively large HTTP request payloads, concurrent large request payloads). Until patched, this is only a concern on deployments with network access to the Consul agent HTTP API endpoint \u2014 products utilizing Consul client libraries without exposing the Consul agent HTTP endpoint are unaffected \u2014 so restrict network access to the Consul agent HTTP API endpoint to trusted callers to prevent unauthenticated payload transmission. As a compensating measure, monitor memory pressure stall information (PSI) and cgroup memory events to detect rapid memory consumption triggered by HTTP requests, impose process virtual memory limits (RLIMIT_AS) via ulimit or prlimit to cap maximum memory allocation for the agent process, configure systemd automatic restart policies and watchdog timers to recover the service if an out-of-memory crash occurs, enforce memory limits via cgroups v2 to bound the agent memory footprint and protect host resources, and apply rate limiting and connection throttling to restrict incoming HTTP request frequency and volume. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory allocation defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)"}, "name": "CVE-2026-105626", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-26T18:02:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105626\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105626\nhttps://discuss.hashicorp.com/t/hcsec-2026-48-consul-vulnerable-to-a-denial-of-service-in-http-apis/77913"], "statement": "This vulnerability is rated as Important severity because unauthenticated network actors can trigger unbounded memory allocation, resulting in process termination and a complete service outage. In Red Hat Enterprise Linux, this flaw is tracked against packages such as Grafana that vendor Consul dependencies. However, because these products utilize client libraries rather than exposing the Consul agent HTTP endpoint, practical exploitation risk in standard Red Hat deployments is substantially minimized.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": ["64_bit", "32_bit", "x86", "arm", "macos", "windows", "linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0.6.0,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Consul", "source": "cna", "vendor": "HashiCorp"}, "product": "consul", "vendor": "hashicorp"}, {"configurations": [{"platform": ["64_bit", "32_bit", "x86", "arm", "macos", "windows", "linux"], "status": "affected", "versions": {"scheme": "semver", "value": "[0.6.0,1.21.19)"}}, {"platform": ["64_bit", "32_bit", "x86", "arm", "macos", "windows", "linux"], "status": "unaffected", "versions": {"scheme": "semver", "value": "[1.21.19,2.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Consul Enterprise", "source": "cna", "vendor": "HashiCorp"}, "product": "consul_enterprise", "vendor": "hashicorp"}], "created": "2026-10-26T19:24:34.032577+00:00", "updated": "2026-10-26T19:30:15.540354+00:00", "vendors": ["hashicorp", "hashicorp$PRODUCT$consul", "hashicorp$PRODUCT$consul_enterprise"]}