Vulnerability-Lookup

CVE-2026-19113 (GCVE-0-2026-19113)

Vulnerability from cvelistv5 – Published: 2026-08-07 19:20 – Updated: 2026-08-10 18:24

Title

Unauthenticated denial of service via unbounded request body processing

Summary

Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-10 17:35 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

HashiCorp

References

1 reference

URL	Tags
https://discuss.hashicorp.com/t/hcsec-2026-25-mul…

Impacted products

2 products

Vendor	Product	Version
HashiCorp	Consul	Affected: 1.3.0 , < 2.0.3 (semver)
HashiCorp	Consul Enterprise	Affected: 1.3.0 , < 2.0.3 (semver)

Credits

This issue was reported by Yazdan Soltani.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-10T17:35:30.416179Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-10T18:24:08.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul Enterprise",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.21.17",
                  "status": "unaffected"
                },
                {
                  "at": "1.22.11",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was reported by Yazdan Soltani."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eConsul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469: HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T19:20:32.261Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629"
        }
      ],
      "source": {
        "advisory": "HCSEC-2026-25",
        "discovery": "EXTERNAL"
      },
      "title": "Unauthenticated denial of service via unbounded request body processing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2026-19113",
    "datePublished": "2026-08-07T19:20:32.261Z",
    "dateReserved": "2026-08-06T14:10:14.667Z",
    "dateUpdated": "2026-08-10T18:24:08.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-19113",
      "date": "2026-08-14",
      "epss": "0.00293",
      "percentile": "0.21699"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-19113\",\"sourceIdentifier\":\"security@hashicorp.com\",\"published\":\"2026-08-07T20:16:50.787\",\"lastModified\":\"2026-08-10T19:17:29.733\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.\"}],\"affected\":[{\"source\":\"security@hashicorp.com\",\"affectedData\":[{\"vendor\":\"HashiCorp\",\"product\":\"Consul\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/consul\",\"versions\":[{\"version\":\"1.3.0\",\"lessThan\":\"2.0.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"HashiCorp\",\"product\":\"Consul Enterprise\",\"defaultStatus\":\"unaffected\",\"platforms\":[\"64 bit\",\"32 bit\",\"x86\",\"ARM\",\"MacOS\",\"Windows\",\"Linux\"],\"repo\":\"https://github.com/hashicorp/consul\",\"versions\":[{\"version\":\"1.3.0\",\"lessThan\":\"2.0.3\",\"versionType\":\"semver\",\"status\":\"affected\",\"changes\":[{\"at\":\"1.21.17\",\"status\":\"unaffected\"},{\"at\":\"1.22.11\",\"status\":\"unaffected\"}]}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-10T17:35:30.416179Z\",\"id\":\"CVE-2026-19113\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@hashicorp.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629\",\"source\":\"security@hashicorp.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-13T17:32:26+00:00",
      "cve": "CVE-2026-19113",
      "id": "CVE-2026-19113",
      "initial_release_date": "2026-08-07T19:20:32.261000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "consul: Consul: Unauthenticated denial of service via unbounded request body processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19113.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19113\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-10T17:35:30.416179Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-10T17:37:13.450Z\"}}], \"cna\": {\"title\": \"Unauthenticated denial of service via unbounded request body processing\", \"source\": {\"advisory\": \"HCSEC-2026-25\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was reported by Yazdan Soltani.\"}], \"impacts\": [{\"capecId\": \"CAPEC-469\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-469: HTTP DoS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/hashicorp/consul\", \"vendor\": \"HashiCorp\", \"product\": \"Consul\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.3.0\", \"lessThan\": \"2.0.3\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://github.com/hashicorp/consul\", \"vendor\": \"HashiCorp\", \"product\": \"Consul Enterprise\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"1.21.17\", \"status\": \"unaffected\"}, {\"at\": \"1.22.11\", \"status\": \"unaffected\"}], \"version\": \"1.3.0\", \"lessThan\": \"2.0.3\", \"versionType\": \"semver\"}], \"platforms\": [\"64 bit\", \"32 bit\", \"x86\", \"ARM\", \"MacOS\", \"Windows\", \"Linux\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eConsul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.\u003c/p\u003e\u003cbr/\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"shortName\": \"HashiCorp\", \"dateUpdated\": \"2026-08-07T19:20:32.261Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-19113\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T18:24:08.086Z\", \"dateReserved\": \"2026-08-06T14:10:14.667Z\", \"assignerOrgId\": \"67fedba0-ff2e-4543-ba5b-aa93e87718cc\", \"datePublished\": \"2026-08-07T19:20:32.261Z\", \"assignerShortName\": \"HashiCorp\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-19113

Vulnerability from fkie_nvd - Published: 2026-08-07 20:16 - Updated: 2026-08-10 19:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security@hashicorp.com	https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul Enterprise",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.21.17",
                  "status": "unaffected"
                },
                {
                  "at": "1.22.11",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.0.3",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@hashicorp.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3."
    }
  ],
  "id": "CVE-2026-19113",
  "lastModified": "2026-08-10T19:17:29.733",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security@hashicorp.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-19113",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-10T17:35:30.416179Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T20:16:50.787",
  "references": [
    {
      "source": "security@hashicorp.com",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629"
    }
  ],
  "sourceIdentifier": "security@hashicorp.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security@hashicorp.com",
      "type": "Secondary"
    }
  ]
}

GHSA-27M6-255M-6Q58

Vulnerability from github – Published: 2026-08-07 21:30 – Updated: 2026-08-07 21:30

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-19113"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-07T20:16:50Z",
    "severity": "MODERATE"
  },
  "details": "Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.",
  "id": "GHSA-27m6-255m-6q58",
  "modified": "2026-08-07T21:30:38Z",
  "published": "2026-08-07T21:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19113"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

ubuntu-cve-2026-19113

Vulnerability from osv_ubuntu

Published

2026-08-07 20:16

Modified

2026-08-13 00:02

Summary

Details

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-19113	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-19113	REPORT
	https://discuss.hashicorp.com/t/hcsec-2026-25-mul…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "consul",
            "binary_version": "0.6.4~dfsg-3"
          },
          {
            "binary_name": "golang-github-hashicorp-consul-dev",
            "binary_version": "0.6.4~dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "consul",
        "purl": "pkg:deb/ubuntu/consul@0.6.4~dfsg-3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.4~dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "consul",
            "binary_version": "1.5.2+dfsg2-14"
          },
          {
            "binary_name": "golang-github-hashicorp-consul-dev",
            "binary_version": "1.5.2+dfsg2-14"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "consul",
        "purl": "pkg:deb/ubuntu/consul@1.5.2+dfsg2-14?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.7~dfsg1-5ubuntu1",
        "1.4.4~dfsg1-2ubuntu2",
        "1.5.2+dfsg1-6",
        "1.5.2+dfsg1-10",
        "1.5.2+dfsg1-12",
        "1.5.2+dfsg2-14"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "consul",
            "binary_version": "1.8.7+dfsg1-3"
          },
          {
            "binary_name": "golang-github-hashicorp-consul-dev",
            "binary_version": "1.8.7+dfsg1-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "consul",
        "purl": "pkg:deb/ubuntu/consul@1.8.7+dfsg1-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.4+dfsg1-1",
        "1.8.7+dfsg1-3"
      ]
    }
  ],
  "aliases": [],
  "details": "Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.",
  "id": "UBUNTU-CVE-2026-19113",
  "modified": "2026-08-13T00:02:19Z",
  "published": "2026-08-07T20:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-19113"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19113"
    },
    {
      "type": "REPORT",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impacting-hashicorp-consul/77629"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-19113"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-19113 (GCVE-0-2026-19113)

FKIE_CVE-2026-19113

GHSA-27M6-255M-6Q58

ubuntu-cve-2026-19113

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature