CVE-2024-10006: Consul L7 Intentions Vulnerable To Headers Bypass
Modified
AliasesUBUNTU-CVE-2024-10006DEBIAN-CVE-2024-10006GHSA-5c4w-8hhh-3c3hBIT-consul-2024-10006GO-2024-3241CGA-22mg-733m-5jvjCGA-23qx-vhvm-4gv7CGA-279j-9wr9-mwf4CGA-2g45-jpqw-vcf7CGA-2h42-jg7g-m39wCGA-2qq4-h3vj-pjv7CGA-2vqh-2f4g-p5g2CGA-326q-hfj5-7qc5CGA-4658-wmg2-2p72CGA-6936-227j-p795CGA-6hvw-rjh6-pxhfCGA-6v3m-7whr-xfqmCGA-6vq4-xf89-mwfrCGA-76fp-pfmc-8g7pCGA-78h2-mmw2-8p69CGA-7wgw-8rh8-4xpqCGA-7wpj-77c8-8mvxCGA-7wqh-2grp-v5wmCGA-862h-xpfm-h69rCGA-8872-vx98-jvvfCGA-9mf6-76rv-gx22CGA-c3jm-648c-q74fCGA-c66r-q7x7-v9r2CGA-c752-5q4x-6q48CGA-cg35-m46g-4h8qCGA-cgq2-8924-28q8CGA-crq8-pp5w-7fx8CGA-cv3h-32m9-gj7gCGA-f2vh-gmw4-cvvwCGA-f5jg-pcmg-cmh9CGA-f8hh-985x-m648CGA-f9mj-j4pw-qrvgCGA-fq73-wr83-vgq8CGA-fwgp-fpxq-4wffCGA-g2pc-gff5-462hCGA-h8x7-9qpp-q379CGA-hr46-rf5q-ffg2CGA-j35h-cvrw-vc39CGA-jx3c-3cj7-pr3jCGA-m774-wrq7-p65qCGA-pm26-qw35-92j8CGA-prpq-qp8p-pvh9CGA-pv8j-qvh3-wvq8CGA-pvch-hx2g-p755CGA-q455-h6wf-f3gvCGA-qjvp-39m2-g75qCGA-qv2v-3f6g-fg52CGA-rc2v-vr69-5f2cCGA-rhf8-jcg4-wwxgCGA-v23p-xx97-6fccCGA-v682-7xmx-6mj2CGA-vg2c-mw22-g42pCGA-w35h-v9qp-9jf6CGA-xg9h-8jc7-x45h
Published 30-10-2024Last modified 10-01-2025
Vulnerability summary
CVE-2024-10006 is a high (CVSS 8.3) vulnerability in hashicorp consul. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.3 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
8.3/10
010
High · v3.1 (CVE.org)EPSS score
0.47%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 6Timeline
- 30-10-2024PublishedVulnerability first disclosed.
- 10-01-2025Last modifiedVulnerability information updated.
Description
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
CVSS metrics
7 scores · 6 sources · 2 versionsMedium 6.9Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:LSourcesSingle source
High 8.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LSources6 sources · 5.8–8.3
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NDiffers
- OSV · GoEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.47% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-644Improper Neutralization of HTTP Headers for Scripting SyntaxThe product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard21 products
- consul-1.18< 1.18.2-r44 | < 1.18.2-r48
- consul-1.19< 1.19.2-r47 | < 1.19.2-r43
- consul-1.20< 1.20.6-r11
- consul-1.20-oci-entrypoint< 1.20.6-r11
- consul-1.20-oci-entrypoint-compat< 1.20.6-r11
Hashicorp2 products
- consulEOL≥ 1.9.0, < 1.20.1 | ≥ 1.4.1, < 1.20.1 | ≥ 1.9.0, < 1.15.15 | ≥ 1.18.0, < 1.18.5 | ≥ 1.19.0, < 1.19.3 | 1.20.0
- consul enterprise≥ 1.9.0, < 1.20.1
Debian1 product
- consulAll versions (No fix recorded)
Github.com/hashicorp1 product
- consul≥ 1.9.0, < 1.20.1
Ubuntu1 product
- consulAll versions (No fix recorded)
5 vendors · 26 products
References
12 links
- github.com/hashicorp/consulPACKAGE