Suggestions search

All statuses

Filter by:

With package: consul

Found 13 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-19015

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month ago Activity log

Created suggestion 1 month ago

Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

References

https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impactin…

Affected products

Consul

<2.0.3

Consul Enterprise

<2.0.3

Matching in nixpkgs

pkgs.consul

Tool for service discovery, monitoring and configuration

nixos-unstable 1.22.7
- nixpkgs-unstable 1.22.7
- nixos-unstable-small 1.22.7
nixos-26.05 1.22.7
- nixos-26.05-small 1.22.7
- nixpkgs-26.05-darwin 1.22.7

pkgs.envconsul

Read and set environmental variables for processes from Consul

nixos-unstable 0.13.4
- nixpkgs-unstable 0.13.4
- nixos-unstable-small 0.14.0
nixos-26.05 0.13.4
- nixos-26.05-small 0.13.4
- nixpkgs-26.05-darwin 0.13.4

pkgs.consul-alerts

Highly available daemon for sending notifications and reminders based on Consul health checks

nixos-unstable 0.6.0
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0
nixos-26.05 0.6.0
- nixos-26.05-small 0.6.0
- nixpkgs-26.05-darwin 0.6.0

pkgs.consul-template

Generic template rendering and notifications with Consul

nixos-unstable 0.41.4
- nixpkgs-unstable 0.41.4
- nixos-unstable-small 0.41.4
nixos-26.05 0.41.4
- nixos-26.05-small 0.41.4
- nixpkgs-26.05-darwin 0.41.4

pkgs.python313Packages.consul

Python client for Consul (https://www.consul.io/)

nixos-unstable 1.7.1
- nixpkgs-unstable 1.7.1
- nixos-unstable-small 1.7.1
nixos-26.05 1.7.1
- nixos-26.05-small 1.7.1
- nixpkgs-26.05-darwin 1.7.1

pkgs.python314Packages.consul

Python client for Consul (https://www.consul.io/)

nixos-unstable 1.7.1
- nixpkgs-unstable 1.7.1
- nixos-unstable-small 1.7.1
nixos-26.05 1.7.1
- nixos-26.05-small 1.7.1
- nixpkgs-26.05-darwin 1.7.1

pkgs.prometheus-consul-exporter

Prometheus exporter for Consul metrics

nixos-unstable 0.13.0
- nixpkgs-unstable 0.13.0
- nixos-unstable-small 0.13.0
nixos-26.05 0.13.0
- nixos-26.05-small 0.13.0
- nixpkgs-26.05-darwin 0.13.0

pkgs.terraform-providers.consul

None

nixos-unstable 2.23.0
- nixpkgs-unstable 2.23.0
nixos-26.05 2.23.0
- nixos-26.05-small 2.23.0
- nixpkgs-26.05-darwin 2.23.0

pkgs.terraform-providers.hashicorp_consul

None

nixos-unstable 2.23.0
- nixpkgs-unstable 2.23.0
- nixos-unstable-small 2.23.0
nixos-26.05 2.23.0
- nixos-26.05-small 2.23.0
- nixpkgs-26.05-darwin 2.23.0

Package maintainers

@vdemeester Vincent Demeester <vincent@sbr.pm>
@nh2 Niklas Hambüchen <mail@nh2.me>
@techknowlogick techknowlogick <techknowlogick@gitea.com>
@cpcloud Phillip Cloud
@hectorj Hector Jusforgues <hector.jusforgues+nixos@gmail.com>
@panicgh Nicolas Benes <nbenes.gh@xandea.de>

Untriaged

Permalink CVE-2026-19014

4.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 1 month ago Activity log

Created suggestion 1 month ago

Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-190124, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

References

https://discuss.hashicorp.com/t/hcsec-2026-25-multiple-vulnerabilities-impactin…

Affected products

Consul

<2.0.3

Consul Enterprise

<2.0.3

Matching in nixpkgs

pkgs.consul

Tool for service discovery, monitoring and configuration

nixos-unstable 1.22.7
- nixpkgs-unstable 1.22.7
- nixos-unstable-small 1.22.7
nixos-26.05 1.22.7
- nixos-26.05-small 1.22.7
- nixpkgs-26.05-darwin 1.22.7

pkgs.envconsul

Read and set environmental variables for processes from Consul

nixos-unstable 0.13.4
- nixpkgs-unstable 0.13.4
- nixos-unstable-small 0.14.0
nixos-26.05 0.13.4
- nixos-26.05-small 0.13.4
- nixpkgs-26.05-darwin 0.13.4

pkgs.consul-alerts

Highly available daemon for sending notifications and reminders based on Consul health checks

nixos-unstable 0.6.0
- nixpkgs-unstable 0.6.0
- nixos-unstable-small 0.6.0
nixos-26.05 0.6.0
- nixos-26.05-small 0.6.0
- nixpkgs-26.05-darwin 0.6.0

pkgs.consul-template

Generic template rendering and notifications with Consul

nixos-unstable 0.41.4
- nixpkgs-unstable 0.41.4
- nixos-unstable-small 0.41.4
nixos-26.05 0.41.4
- nixos-26.05-small 0.41.4
- nixpkgs-26.05-darwin 0.41.4

pkgs.python313Packages.consul

Python client for Consul (https://www.consul.io/)

nixos-unstable 1.7.1
- nixpkgs-unstable 1.7.1
- nixos-unstable-small 1.7.1
nixos-26.05 1.7.1
- nixos-26.05-small 1.7.1
- nixpkgs-26.05-darwin 1.7.1

pkgs.python314Packages.consul

Python client for Consul (https://www.consul.io/)

nixos-unstable 1.7.1
- nixpkgs-unstable 1.7.1
- nixos-unstable-small 1.7.1
nixos-26.05 1.7.1
- nixos-26.05-small 1.7.1
- nixpkgs-26.05-darwin 1.7.1

pkgs.prometheus-consul-exporter

Prometheus exporter for Consul metrics

nixos-unstable 0.13.0
- nixpkgs-unstable 0.13.0
- nixos-unstable-small 0.13.0
nixos-26.05 0.13.0
- nixos-26.05-small 0.13.0
- nixpkgs-26.05-darwin 0.13.0

pkgs.terraform-providers.consul

None

nixos-unstable 2.23.0
- nixpkgs-unstable 2.23.0
nixos-26.05 2.23.0
- nixos-26.05-small 2.23.0
- nixpkgs-26.05-darwin 2.23.0

pkgs.terraform-providers.hashicorp_consul

None

nixos-unstable 2.23.0
- nixpkgs-unstable 2.23.0
- nixos-unstable-small 2.23.0
nixos-26.05 2.23.0
- nixos-26.05-small 2.23.0
- nixpkgs-26.05-darwin 2.23.0

Package maintainers

@vdemeester Vincent Demeester <vincent@sbr.pm>
@nh2 Niklas Hambüchen <mail@nh2.me>
@techknowlogick techknowlogick <techknowlogick@gitea.com>
@cpcloud Phillip Cloud
@hectorj Hector Jusforgues <hector.jusforgues+nixos@gmail.com>
@panicgh Nicolas Benes <nbenes.gh@xandea.de>

Untriaged

Permalink CVE-2026-2808

6.8 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): High (H)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 5 months, 4 weeks ago Activity log

Created suggestion 5 months, 4 weeks ago

Consul vulnerable to arbitrary file reads through the vault kubernetes authentication provider

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.