CVE-2026-87106— Consul vulnerable to a denial of service in the native RPC listener
Quick assessment
Affected
HashiCorp Consul
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Consul 和 Consul Enterprise 的原生 RPC 监听器存在拒绝服务（DoS）漏洞，经过身份验证的客户端可能在 ACL 授权评估之前耗尽服务器内存。能够完成内部 RPC mTLS 握手的客户端，即使不持有有效的 ACL 令牌，也可能利用此漏洞。该漏洞（CVE-2026-87106）已在 Consul 2.0.4 以及 Consul Enterprise 1.21.18、1.22.12 和 2.0.4 中修复。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Consul | 1.21.0< 2.0.4 |
affected |
| HashiCorp | Consul Enterprise | 1.21.0< 2.0.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87106
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Consul vulnerable to a denial of service in the native RPC listener
Source: CVE Program / CVE List V5
Vulnerability Description
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Consul | 1.21.0 ~ 2.0.4 | - |
|
| HashiCorp | Consul Enterprise | 1.21.0 ~ 2.0.4 | - |
|
II. Public POCs for CVE-2026-87106
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87106
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87106 (1)
Same Patch Batch · HashiCorp · 2026-09-10 · 5 CVEs total
| CVE-2026-87090 | 8.3 HIGH | Consul vulnerable to an authorization bypass in the catalog node-write path |
| CVE-2026-87993 | 7.7 HIGH | Consul-template vulnerable to an information disclosure issue in error handling |
| CVE-2026-88021 | 7.5 HIGH | Consul vulnerable to an authorization bypass in the Connect service mesh |
| CVE-2026-87107 | 5.4 MEDIUM | Consul vulnerable to an authorization bypass in the catalog deregistration path |
IV. Related Vulnerabilities
Same product: Consul
-
CVE-2026-88021
Consul vulnerable to an authorization bypass in the Connect -
CVE-2026-87107
Consul vulnerable to an authorization bypass in the catalog -
CVE-2026-87090
Consul vulnerable to an authorization bypass in the catalog -
CVE-2026-19113
Unauthenticated denial of service via unbounded request body -
CVE-2026-15972
Unauthenticated denial of service via unbounded external gRP
Same vendor: HashiCorp
-
CVE-2026-87993
Consul-template vulnerable to an information disclosure issu -
CVE-2026-88021
Consul vulnerable to an authorization bypass in the Connect -
CVE-2026-87107
Consul vulnerable to an authorization bypass in the catalog -
CVE-2026-87090
Consul vulnerable to an authorization bypass in the catalog -
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection
Same weakness: CWE-400
-
CVE-2026-45769
ikev2: unbounded client transform storage can lead to resour -
CVE-2026-45768
Suricata ldap: unbounded responses per transaction can lead -
CVE-2026-45766
Suricata nfs: unbounded stateful structures can lead to reso -
CVE-2026-45765
Suricata dnp3: unbounded reassembly can lead to resource exh -
CVE-2026-45759
Suricata http1: quadratic Content-Disposition processing can
V. Comments for CVE-2026-87106
No comments yet