Approved changes feed: RSS · Atom
cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*
part: a version: * update: *
| Vendor | Hashicorp (dc524c16-6a01-528e-a41c-9d3e02e5e4a3) |
|---|---|
| Product | Consul (5323a3d1-770c-5792-8baa-0ccc723628c6) |
| Edition | * |
| Language | * |
| Software edition | - |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/consul |
purl2cpe | 2026-06-01 10:14:57.184026 |
pkg:deb/ubuntu/consul |
purl2cpe | 2026-06-01 10:14:57.184028 |
pkg:github/hashicorp/consul |
purl2cpe | 2026-06-01 10:14:57.184030 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-11375 |
vulnerable | 2026-06-08 07:02:28.675566 |
Consul's event endpoint is vulnerable to denial of service
MEDIUM (6.5)
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Published: 2025-10-28T20:12:14.325Z
Updated: 2025-12-09T01:37:57.188Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11374 |
vulnerable | 2026-06-08 07:02:28.675080 |
Consul's KV endpoint is vulnerable to denial of service
MEDIUM (6.5)
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Published: 2025-10-28T20:19:05.292Z
Updated: 2026-04-17T18:34:14.829Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-5332 |
vulnerable | 2026-06-08 06:19:43.224974 |
Dependency on Vulnerable Third-Party Component in GitLab
MEDIUM (5.9)
Patch in third party library Consul requires 'enable-script-checks' to be set to False. This was required to enable a patch by the vendor. Without this setting the patch could be bypassed. This only affects GitLab-EE.
Published: 2023-12-04T06:30:33.856Z
Updated: 2024-10-03T06:23:16.051Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2816 |
vulnerable | 2026-06-08 06:02:43.130986 |
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
HIGH (8.7)
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
Published: 2023-06-02T22:43:34.553Z
Updated: 2024-10-07T20:12:01.627Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1297 |
vulnerable | 2026-06-08 05:52:34.351640 |
Consul Cluster Peering can Result in Denial of Service
MEDIUM (4.9)
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
Published: 2023-06-02T22:48:28.938Z
Updated: 2025-01-08T17:51:02.037Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0845 |
vulnerable | 2026-06-08 05:52:32.939468 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-40716 |
vulnerable | 2026-06-08 05:48:28.011630 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3920 |
vulnerable | 2026-06-08 05:48:22.629461 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-29153 |
vulnerable | 2026-06-08 05:42:47.012967 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24687 |
vulnerable | 2026-06-08 05:41:01.377580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41803 |
vulnerable | 2026-06-08 05:35:21.061525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3121 |
vulnerable | 2026-06-08 05:33:50.802584 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-38698 |
vulnerable | 2026-06-08 05:33:48.322269 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37219 |
vulnerable | 2026-06-08 05:32:53.960705 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36213 |
vulnerable | 2026-06-08 05:32:50.105205 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32574 |
vulnerable | 2026-06-08 05:32:07.462719 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-28053 |
vulnerable | 2026-06-08 05:23:53.744360 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-25864 |
vulnerable | 2026-06-08 05:23:49.596011 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.