6.5Medium
CVE-2025-11374Consul's KV endpoint is vulnerable to denial of service
Description
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Weakness (CWE):
CWE-770
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| HashiCorp | Consul | < 1.22.0 | |
| HashiCorp | Consul Enterprise | < 1.22.0 |
References and patches
CPE matches (NVD) (4)
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*< 1.18.12cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*< 1.22.0cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*≥ 1.19.0 < 1.20.8cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*≥ 1.21.0 < 1.21.6