CVE-2026-87106
No fix known EPSS <1%CVSS 6.5
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.22 | no fix |
| Chainguard | consul-fips-1.22 | no fix |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |