Quick answers
- Is CVE-2026-87106 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87106 being exploited in the wild.
- How severe is CVE-2026-87106?
- Medium severity, with a CVSS score of 6.5, published 10 September 2026.
- Which products and versions are affected?
- HashiCorp Consul 1.21.0 through 2.0.3; HashiCorp Consul Enterprise 1.21.0 through 2.0.3.
- Is there a fix for CVE-2026-87106?
- A patch was published on 2026-09-10: Fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-87106 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-87106?
- Check whether you run HashiCorp Consul or HashiCorp Consul Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a denial-of-service flaw in the native RPC request decoder that fails to enforce limits on request header data size before processing. An authenticated client that completes the mTLS handshake can send a specially crafted RPC request to exhaust server memory, causing process termination and control-plane unavailability. While authentication (mTLS certificate) is required, no valid ACL token is needed; exploitation requires network access to the RPC listener (typically TCP port 8300). Patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Affected products
- HashiCorp Consul 1.21.0 through 2.0.3
- HashiCorp Consul Enterprise 1.21.0 through 2.0.3
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4