CVE-2026-105626: Consul vulnerable to a denial of service in HTTP APIs

Awaiting analysis

AliasesUBUNTU-CVE-2026-105626CGA-w7m2-r2g8-gvx5CGA-5hpq-xvw6-435v+8 more

Published 26-10-2026Last modified 26-10-2026

Vulnerability summary

CVE-2026-105626 is a high (CVSS 7.5) vulnerability in hashicorp consul. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · Change unavailable

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

26-10-2026
PublishedVulnerability first disclosed.
26-10-2026
Last modifiedVulnerability information updated.

Description

HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

Change unavailable

27-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard4 products

consul-1.22All versions (No fix recorded)
consul-2.0All versions (No fix recorded)
consul-fips-1.22All versions (No fix recorded)
consul-fips-2.0All versions (No fix recorded)

Hashicorp2 products

consul≥ 0.6.0, < 2.1.0
consul enterprise≥ 0.6.0, < 2.1.0

Ubuntu1 product

consulAll versions (No fix recorded)

3 vendors · 7 products

References

8 links