Executive brief
HashiCorp Consul is a service mesh and infrastructure automation platform used to manage distributed systems and microservices. The native RPC listener—a critical internal communication channel between Consul servers and agents—lacks request size limits, allowing authenticated clients to cause memory exhaustion and crash the control plane without needing valid security credentials. This disrupts service discovery, routing, and cluster operations.
Technical details
The vulnerability is a denial-of-service flaw in the native RPC request decoder that fails to enforce limits on request header data size before processing. An authenticated client that completes the mTLS handshake can send a specially crafted RPC request to exhaust server memory, causing process termination and control-plane unavailability. While authentication (mTLS certificate) is required, no valid ACL token is needed; exploitation requires network access to the RPC listener (typically TCP port 8300). Patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Affected products
- HashiCorp Consul 1.21.0 through 2.0.3
- HashiCorp Consul Enterprise 1.21.0 through 2.0.3
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4