CVE-2026-19113 Unauthenticated denial of service via unbounded request body processing
Remote attackers can cause memory exhaustion and denial of service in Consul agents via unbounded request body processing in HTTP API endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19113?
CVE-2026-19113 is a medium-severity denial of service vulnerability in HashiCorp Consul, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This vulnerability, CVE-2026-19113, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Weakness: CWE-400
Which versions are affected by CVE-2026-19113?
1 open source package ship an affected version, including consul.
| Package | Affected | Fixed in |
|---|---|---|
consul Bitnami | From 1.3.0 | 2.0.3 |
How do I fix CVE-2026-19113?
Upgrade consul to 2.0.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-19113 being exploited?
There is no known exploitation of CVE-2026-19113 in the wild and no public exploit code.
Sources
Also known as BIT-consul-2026-19113, DEBIAN-CVE-2026-19113, GHSA-27m6-255m-6q58, MINI-fw8m-cvr6-c278, MINI-vwcm-56jp-r8xq, UBUNTU-CVE-2026-19113.