CVE-2026-105626
Description
A flaw was found in HashiCorp Consul. An unauthenticated remote attacker can exploit this vulnerability through the HTTP Application Programming Interface (API) to cause excessive memory consumption on a Consul agent. Successful exploitation leads to memory exhaustion and results in a Denial of Service (DoS).
Statement
This vulnerability is rated as Important severity because unauthenticated network actors can trigger unbounded memory allocation, resulting in process termination and a complete service outage. In Red Hat Enterprise Linux, this flaw is tracked against packages such as Grafana that vendor Consul dependencies. However, because these products utilize client libraries rather than exposing the Consul agent HTTP endpoint, practical exploitation risk in standard Red Hat deployments is substantially minimized.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce request body size limits prior to reading and decoding HTTP API payloads on Consul agents: upgrade to Consul Community Edition 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 (or the fixed Grafana builds), which enforce a 512 KiB request body limit on most write endpoints, closing all 2 injection vectors (excessively large HTTP request payloads, concurrent large request payloads). Until patched, this is only a concern on deployments with network access to the Consul agent HTTP API endpoint — products utilizing Consul client libraries without exposing the Consul agent HTTP endpoint are unaffected — so restrict network access to the Consul agent HTTP API endpoint to trusted callers to prevent unauthenticated payload transmission. As a compensating measure, monitor memory pressure stall information (PSI) and cgroup memory events to detect rapid memory consumption triggered by HTTP requests, impose process virtual memory limits (RLIMIT_AS) via ulimit or prlimit to cap maximum memory allocation for the agent process, configure systemd automatic restart policies and watchdog timers to recover the service if an out-of-memory crash occurs, enforce memory limits via cgroups v2 to bound the agent memory footprint and protect host resources, and apply rate limiting and connection throttling to restrict incoming HTTP request frequency and volume. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory allocation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
