CVE-2026-19113 — Unauthenticated denial of service via unbounded request body processing

CVE-2026-19113

Unauthenticated denial of service via unbounded request body processing PUBLISHED

Description (CNA)

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Consul	affected 1.3.0 before 2.0.3
HashiCorp / Consul Enterprise	affected 1.3.0 before 2.0.3

CWE

CWE-400

References

https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.