CVE-2026-15972

A flaw was found in Consul. A remote attacker can exploit this vulnerability by sending numerous incomplete connection requests to the external gRPC (gRPC Remote Procedure Call) listeners. This unbounded connection acceptance can exhaust agent resources, such as file descriptors, goroutines, and memory. The primary consequence is a denial of service, which prevents legitimate clients from connecting to the Consul agent.

This vulnerability is rated as Important because unauthenticated remote attackers can exhaust system resources over the network without requiring privileges, leading to a complete service outage. In typical Red Hat environments, exposure is limited to deployments where external gRPC interfaces are exposed across untrusted networks. While this flaw allows an attacker to starve the host of file descriptors and memory, confidentiality and data integrity remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.