6.5Medium
CVE-2025-11375Consul's event endpoint is vulnerable to denial of service
Description
Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Weakness (CWE):
CWE-770
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| HashiCorp | Consul | < 1.22.0 | |
| HashiCorp | Consul Enterprise | < 1.22.0 |
References and patches
CPE matches (NVD) (4)
cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*< 1.18.12cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*< 1.22.0cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*≥ 1.19.0 < 1.20.8cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*≥ 1.21.0 < 1.21.6