Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Consul Denial of Service in Downgrade Path

CVE-2026-19012 · published 2 months ago
Summary

Consul servers are vulnerable to a denial of service attack that can crash the server. This happens when an authorized user with permission to change configuration settings submits a specific request that causes the server to stop working. To fix this, update to Consul 2.0.3 or later versions of Consul Enterprise.

What to do
  • Update hashicorp consul enterprise to version 1.22.11.
  • Update consul to version 2.0.3.
  • Update hashicorp consul to version 2.0.3 or later.
Affected software
Ecosystem VendorProductAffected versions
– hashicorp consul < 2.0.3
– hashicorp consul enterprise < 2.0.3
Fix: upgrade to 1.22.11
Debian:11 debian consul All versions
Bitnami – consul >= 1.18.0, < 2.0.3
Fix: upgrade to 2.0.3
Original advisory text
Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path
Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a service-router configuration entry that causes the agent to exit unexpectedly. This vulnerability, CVE-2026-19012, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published7 Aug 2026
Updated4 Nov 2026
First seen7 Aug 2026
Sources
DEBIAN-CVE-2026-19012 · OSV
CVE-2026-19012 · OSV
CVE-2026-19012 · NVD
CVE-2026-19012 · MITRE
BIT-consul-2026-19012 · OSV
Track software like this
Free during beta