Go Package Vulnerabilities
Vulnerabilities associated with github.com/hashicorp/consul.
Packages
Clear package- github.com/mattermost/mattermost/server/v8199 vulnerabilities
- github.com/mattermost/mattermost-server178 vulnerabilities
- code.gitea.io/gitea94 vulnerabilities
- gogs.io/gogs76 vulnerabilities
- github.com/usememos/memos74 vulnerabilities
- github.com/grafana/grafana61 vulnerabilities
- github.com/rancher/rancher61 vulnerabilities
- github.com/siyuan-note/siyuan/kernel58 vulnerabilities
- github.com/hashicorp/vault55 vulnerabilities
- github.com/traefik/traefik/v253 vulnerabilities
- github.com/traefik/traefik/v352 vulnerabilities
- github.com/mattermost/mattermost-server/v647 vulnerabilities
- github.com/filebrowser/filebrowser/v243 vulnerabilities
- k8s.io/kubernetes43 vulnerabilities
- github.com/zitadel/zitadel41 vulnerabilities
- github.com/argoproj/argo-cd/v237 vulnerabilities
- github.com/cilium/cilium37 vulnerabilities
- github.com/docker/docker36 vulnerabilities
- github.com/answerdev/answer34 vulnerabilities
- github.com/argoproj/argo-cd34 vulnerabilities
- github.com/hashicorp/nomad34 vulnerabilities
- code.vikunja.io/api33 vulnerabilities
- github.com/hashicorp/consul32 vulnerabilities
- github.com/openbao/openbao29 vulnerabilities
- github.com/traefik/traefik29 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-2808MEDIUM | Consul vulnerable to arbitrary file reads through the vault kubernetes authentication providerHashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5. CWE-59Mar 11, 2026 | CVSS6.8v3.1 | EPSS0.475% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-11374MEDIUM | Consul's KV endpoint is vulnerable to denial of serviceConsul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. CWE-770Oct 28, 2025 | CVSS6.5v3.1 | EPSS0.396% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-11375MEDIUM | Consul's event endpoint is vulnerable to denial of serviceConsul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12. CWE-770Oct 28, 2025 | CVSS6.5v3.1 | EPSS0.393% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Consul Vulnerable To Reflected XSS On Content-Type Error ManipulationA vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS. CWE-79Oct 30, 2024 | CVSS-v4.0 | EPSS0.418% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Consul L7 Intentions Vulnerable To Headers BypassA vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules. | CVSS-v4.0 | EPSS0.463% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Consul L7 Intentions Vulnerable To URL Path BypassA vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules. CWE-22Oct 30, 2024 | CVSS-v4.0 | EPSS0.715% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2023-3518HIGH | JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for AccessHashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1. | CVSS7.4v3.1 | EPSS0.447% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-1297MEDIUM | Consul Cluster Peering can Result in Denial of ServiceConsul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3 CWE-826Jun 2, 2023 | CVSS4.9v3.1 | EPSS0.768% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-2816HIGH | Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service OwnerConsul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies. CWE-266Jun 2, 2023 | CVSS8.7v3.1 | EPSS0.585% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-0845MEDIUM | Consul Server Panic when Ingress and API Gateways Configured with PeeringConsul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5. CWE-476Mar 9, 2023 | CVSS4.9v3.1 | EPSS1.01% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-3920MEDIUM | Consul Peering Imported Nodes/Services LeakHashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0. CWE-862Nov 15, 2022 | CVSS5.3v3.1 | EPSS0.66% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-41803HIGH | HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertionsHashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2." CWE-862Sep 23, 2022 | CVSS7.1v3.1 | EPSS0.878% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-40716MEDIUM | HashiCorp Consul vulnerable to authorization bypassHashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2." CWE-252Sep 23, 2022 | CVSS6.5v3.1 | EPSS0.881% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-29153HIGH | Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorHashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5. | CVSS7.5v3.1 | EPSS8.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2022-24687MEDIUM | HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersHashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3. CWE-400Feb 24, 2022 | CVSS6.5v3.1 | EPSS1.39% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-38698MEDIUM | HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. | CVSS6.5v3.1 | EPSS1.52% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-37219HIGH | HashiCorp Consul Privilege Escalation VulnerabilityHashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. CWE-295Sep 7, 2021 | CVSS8.8v3.1 | EPSS1.15% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36213HIGH | HashiCorp Consul L7 deny intention results in an allow actionHashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. Jul 17, 2021 | CVSS7.5v3.1 | EPSS1.74% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-32574HIGH | Hashicorp Consul Missing SSL Certificate ValidationHashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1. CWE-295Jul 17, 2021 | CVSS7.5v3.1 | EPSS1.46% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-25864MEDIUM | HashiCorp Consul Cross-site Scripting vulnerabilityHashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. | CVSS6.1v3.1 | EPSS6.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-28053MEDIUM | Privilege Escalation in HashiCorp ConsulHashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6. | CVSS6.5v3.1 | EPSS1.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-25201HIGH | Denial of service in HashiCorp ConsulHashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. | CVSS7.5v3.1 | EPSS2.61% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-13170HIGH | Improper Input Validation in HashiCorp ConsulHashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. CWE-20Jun 11, 2020 | CVSS7.5v3.1 | EPSS1.73% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-12797MEDIUM | Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulHashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. CWE-732Jun 11, 2020 | CVSS5.3v3.1 | EPSS1.55% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-12758HIGH | Denial of Service (DoS) in HashiCorp ConsulHashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. | CVSS7.5v3.1 | EPSS1.71% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |