CVE-2026-105626

A flaw was found in HashiCorp Consul. An unauthenticated remote attacker can exploit this vulnerability through the HTTP Application Programming Interface (API) to cause excessive memory consumption on a Consul agent. Successful exploitation leads to memory exhaustion and results in a Denial of Service (DoS).

This vulnerability is rated as Important severity because unauthenticated network actors can trigger unbounded memory allocation, resulting in process termination and a complete service outage. In Red Hat Enterprise Linux, this flaw is tracked against packages such as Grafana that vendor Consul dependencies. However, because these products utilize client libraries rather than exposing the Consul agent HTTP endpoint, practical exploitation risk in standard Red Hat deployments is substantially minimized.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce request body size limits prior to reading and decoding HTTP API payloads on Consul agents: upgrade to Consul Community Edition 2.1.0, Consul Enterprise 2.1.0 and 1.21.19 (or the fixed Grafana builds), which enforce a 512 KiB request body limit on most write endpoints, closing all 2 injection vectors (excessively large HTTP request payloads, concurrent large request payloads). Until patched, this is only a concern on deployments with network access to the Consul agent HTTP API endpoint — products utilizing Consul client libraries without exposing the Consul agent HTTP endpoint are unaffected — so restrict network access to the Consul agent HTTP API endpoint to trusted callers to prevent unauthenticated payload transmission. As a compensating measure, monitor memory pressure stall information (PSI) and cgroup memory events to detect rapid memory consumption triggered by HTTP requests, impose process virtual memory limits (RLIMIT_AS) via ulimit or prlimit to cap maximum memory allocation for the agent process, configure systemd automatic restart policies and watchdog timers to recover the service if an out-of-memory crash occurs, enforce memory limits via cgroups v2 to bound the agent memory footprint and protect host resources, and apply rate limiting and connection throttling to restrict incoming HTTP request frequency and volume. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded memory allocation defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)