CVE-2025-11375: hashicorp consul
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-11375DEBIAN-CVE-2025-11375GHSA-qh7p-pfq3-677hBIT-consul-2025-11375GO-2025-4082CGA-2v49-5rgj-j37fCGA-2vgx-xp33-4rw6CGA-34q4-qvjc-v6mfCGA-3f3g-g9f9-57cjCGA-3m79-3cm9-8gv7CGA-48mf-grgq-jw26CGA-4cjf-gj6g-f72mCGA-599q-r4wg-8v65CGA-5vpx-j779-28f2CGA-67pg-j83v-j3pcCGA-6866-cc65-hwf9CGA-6mg9-4662-4ghvCGA-96w2-84f9-66wcCGA-9j78-42vf-5r8rCGA-c6p3-gqw4-p85hCGA-ccj8-mj9h-hcr9CGA-f9rx-jqch-rcfpCGA-frvq-mwg5-rxf9CGA-g538-3cj8-pg3qCGA-g9w8-5g8r-54gcCGA-gf24-hgfq-hgm7CGA-gmm5-4v3r-xhrwCGA-h4x6-pj25-7325CGA-h6wf-3cx2-w4q5CGA-h9xv-55fr-fvw3CGA-hvjm-2r3v-w77fCGA-j5fx-cqhj-7cmmCGA-m658-8hhm-hjfxCGA-mjq3-5796-26v3CGA-qrvr-65gw-px7rCGA-rhjv-mpw9-jf89CGA-rqcm-m8fr-cqqpCGA-v4vf-7gmr-hv9hCGA-v969-qgq2-f9hvCGA-w245-q6jm-38j7CGA-wgc9-3mpq-6vvpCGA-x6m7-j5j4-8chpCGA-xgh2-x7cg-f6fjCGA-xqgm-5f5x-24x4CGA-xrfm-p6hh-fxhq
Published 28-10-2025Last modified 09-12-2025
Vulnerability summary
CVE-2025-11375 is a medium (CVSS 6.5) vulnerability in hashicorp consul. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.43%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 28-10-2025PublishedVulnerability first disclosed.
- 09-12-2025Last modifiedVulnerability information updated.
Description
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.03 pp
From 0.39% on 20-09-2026
20-09-202620-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard13 products
- consul-1.18All versions (No fix recorded)
- consul-1.19All versions (No fix recorded)
- consul-1.20All versions (No fix recorded)
- consul-1.21All versions (No fix recorded)
- consul-1.22< 1.22.1-r2
Hashicorp2 products
- consul< 1.18.12 | < 1.22.0 | ≥ 1.19.0, < 1.20.8 | ≥ 1.21.0, < 1.21.6
- consul enterprise< 1.22.0
Debian1 product
- consulAll versions (No fix recorded)
Github.com/hashicorp1 product
- consul< 1.22.0
Ubuntu1 product
- consulAll versions (No fix recorded)
5 vendors · 18 products
References
12 links
- github.com/hashicorp/consulPACKAGE