Bulletin ID: HCSEC-2026-35
Affected Products / Versions: Consul and Consul Enterprise 1.21.0 through 2.0.3; fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4.
Publication Date: September 10, 2026
Summary
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Background
Consul servers expose a native RPC listener, typically on TCP port 8300, that Consul agents and other cluster members use for internal communication. When mutual TLS is configured, connecting clients must present a certificate signed by the internal RPC certificate authority. ACL policies are then applied to control what operations an authenticated client may perform.
Details
The native RPC request decoder did not enforce limits on the size of request header data before processing it. An authenticated client could send a specially crafted request that caused the server to consume excessive memory before method validation or ACL evaluation could occur, potentially resulting in process termination and interruption of control-plane operations. Exploiting this issue requires the ability to reach the server RPC listener and complete the mTLS handshake. No ACL token is required. Deployments where the server RPC listener is not reachable from untrusted clients are at reduced risk.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Consul 2.0.4 or Consul Enterprise 1.21.18, 1.22.12, or 2.0.4.
Acknowledgement
This issue was reported to HashiCorp by Yazdan Soltani.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.