Vulnerability · Published Sep 10, 2026 · Assigned by HashiCorp
CVE-2026-87106Consul vulnerable to a denial of service in the native RPC listener
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in Consul from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Official description
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | consul | no fix listed | UBUNTU-CVE-2026-87106 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Consul | 1.21.0 – before 2.0.4 |
| HashiCorp | Consul Enterprise | 1.21.0 – before 2.0.4 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H