CVE-2026-19015: 
Consul vulnerability analysis and mitigation

CVE-2026-19015 is an uncontrolled resource consumption vulnerability in the Connect CA roots endpoint of HashiCorp Consul Community Edition and Consul Enterprise. Affected versions span 1.2.0 through 2.0.2, and the flaw allows a remote, unauthenticated caller to grow the Consul agent's Connect CA roots cache without bound, bypassing any operator-configured cache-disable settings. The vulnerability was published on August 7, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, HashiCorp Forum).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the Connect CA roots endpoint does not enforce any cap on how many entries can be accumulated in the agent's in-memory cache, even when the operator has explicitly disabled caching (GitHub Advisory). An attacker can exploit this by repeatedly querying the Connect CA roots endpoint over the network without authentication, causing the cache to grow unboundedly and consuming increasing amounts of agent memory. No special privileges, user interaction, or complex conditions are required — the attack vector is network-accessible and the attack complexity is low (GitHub Advisory). No public proof-of-concept code has been identified at this time.

Successful exploitation results in a denial-of-service condition affecting the Consul agent's availability. An unauthenticated remote attacker can exhaust the agent's memory by continuously sending requests to the Connect CA roots endpoint, potentially degrading service performance or causing the agent to become unavailable entirely (GitHub Advisory, HashiCorp Forum). There is no confidentiality or integrity impact; the vulnerability is limited to availability (partial technical impact per NVD SSVC assessment). In environments where Consul is central to service mesh or service discovery, agent unavailability could disrupt dependent workloads and inter-service communication.

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit as of the time of publication (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable, meaning it could be scripted with minimal effort if targeted. The EPSS score is approximately 0.293% (22nd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible Consul agents running versions 1.2.0 through 2.0.2 using service discovery tools, Shodan, or internal network scanning.
2. Locate the Connect CA roots endpoint: The vulnerable endpoint is the Consul Connect CA roots API (e.g., GET /v1/connect/ca/roots), which is accessible without authentication by default.
3. Send repeated requests: Craft a script or use a tool such as curl or a simple HTTP flood utility to send a high volume of requests to the /v1/connect/ca/roots endpoint on the target Consul agent (default port 8500).
4. Exhaust agent memory: Each request causes the agent to add entries to its Connect CA roots cache without eviction or size limits, even if caching is administratively disabled. Sustained requests grow the cache unboundedly, consuming available memory.
5. Achieve denial of service: As memory is exhausted, the Consul agent's performance degrades and it may eventually become unresponsive or crash, disrupting service mesh operations dependent on the agent (GitHub Advisory, HashiCorp Forum).

• Network: Unusually high volume of HTTP GET requests to /v1/connect/ca/roots from one or more source IPs; repeated requests from unexpected or external sources to Consul's HTTP API port (default 8500 or 8501 for HTTPS).
• Logs: Consul agent access logs showing a sustained spike in requests to the Connect CA roots endpoint; log entries indicating memory pressure or garbage collection events in the Consul process.
• Process/System: Consul agent process (consul) exhibiting abnormal and continuously growing memory consumption (RSS/VSZ) over time; system-level OOM (Out of Memory) killer events targeting the Consul process.
• Metrics: Consul telemetry or monitoring dashboards showing unbounded growth in cache-related memory metrics for the Connect CA subsystem.

HashiCorp has released patched versions that fix this vulnerability: Consul Community Edition 2.0.3, and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Upgrading to one of these versions is the recommended remediation (HashiCorp Forum, GitHub Advisory). If immediate patching is not feasible, operators should implement network-level access controls (e.g., firewall rules, ACLs) to restrict access to the Consul HTTP API — particularly the /v1/connect/ca/roots endpoint — to trusted sources only. Additionally, monitoring Consul agent memory consumption for unusual growth patterns can help detect exploitation attempts early.

HashiCorp disclosed this vulnerability via their security advisory forum (HCSEC-2026-25), which also covered multiple other Consul vulnerabilities in the same release (HashiCorp Forum). No notable independent researcher commentary, social media discussion, or significant media coverage has been identified for this specific CVE beyond standard vulnerability database aggregation.