CVE-2025-11375
Fixed in a distro release EPSS <1%CVSS 6.5
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.22.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.18 | no fix |
| Chainguard | consul-1.19 | no fix |
| Chainguard | consul-1.20 | no fix |
| Chainguard | consul-1.21 | no fix |
| Chainguard | consul-1.22 | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint-compat | 1.22.1-r2 |
| Chainguard | consul-fips-1.19 | no fix |
| Chainguard | consul-fips-1.20 | no fix |
| Chainguard | consul-fips-1.21 | no fix |
| Chainguard | consul-fips-1.22 | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint-compat | 1.22.2-r1 |
| Debian 11 | consul | no fix |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20251105T184115-1.1 |