CVE-2025-11374: hashicorp consul
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-11374DEBIAN-CVE-2025-11374GHSA-7g3r-8c6v-hfmrBIT-consul-2025-11374GO-2025-4081CGA-2mgj-w9gj-xcvxCGA-33x9-ff3m-wwmjCGA-3759-h5fp-28x8CGA-3whx-42x8-qj3wCGA-4q9r-h59v-crcvCGA-4r66-59fw-m3rpCGA-5jf4-w9cw-7pc4CGA-5p8x-g4gm-7979CGA-5vh2-4xpw-84qjCGA-6q3r-5fqf-45vfCGA-6x65-6p4g-w4wcCGA-78x8-55h6-rg3vCGA-8828-35vp-939vCGA-8jj7-mwjg-52gxCGA-8w6f-9645-h2x8CGA-9463-jmm9-hcf8CGA-cpf9-53g5-8v66CGA-f32m-pv7x-3wpgCGA-fhgg-rg35-39wgCGA-g895-rhr5-jg76CGA-gwjg-qpxf-mjp7CGA-hj92-8h5x-wpc6CGA-hrc2-g466-gwp8CGA-j62c-4hf2-wxrjCGA-jcv4-69wg-x3m6CGA-jw3f-73ph-9g5hCGA-mc56-jrvp-7q28CGA-mp94-2m2c-98fmCGA-p48g-c5vr-mw36CGA-p7m8-529q-94f4CGA-p8wv-h628-fj7mCGA-pqcg-wqq6-qg28CGA-q25f-7vj6-7ff2CGA-q3xg-wmpw-7x9pCGA-qcqp-4xfj-j8c8CGA-rc3w-57h7-397wCGA-rmqv-j98h-cmj8CGA-v55f-3x68-wrrxCGA-v6gx-7ffx-xr2vCGA-w4rm-rh2x-m2mr
Published 28-10-2025Last modified 17-04-2026
Vulnerability summary
CVE-2025-11374 is a medium (CVSS 6.5) vulnerability in hashicorp consul. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.43%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 28-10-2025PublishedVulnerability first disclosed.
- 17-04-2026Last modifiedVulnerability information updated.
Description
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.03 pp
From 0.40% on 20-09-2026
20-09-202620-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- consul-1.18All versions (No fix recorded)
- consul-1.19All versions (No fix recorded)
- consul-1.20All versions (No fix recorded)
- consul-1.21All versions (No fix recorded)
- consul-1.22< 1.22.1-r2
Hashicorp2 products
- consul< 1.18.12 | < 1.22.0 | ≥ 1.19.0, < 1.20.8 | ≥ 1.21.0, < 1.21.6
- consul enterprise< 1.22.0
Debian1 product
- consulAll versions (No fix recorded)
Github.com/hashicorp1 product
- consul< 1.22.0
Ubuntu1 product
- consulAll versions (No fix recorded)
5 vendors · 18 products
References
12 links
- github.com/hashicorp/consulPACKAGE