← Back

CVE-2025-11374

nvd nist
Published: Oct 28, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security@hashicorp.com (Secondary)

Description

Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

Affected (4)

Products: Hashicorp: Consul
Hashicorp
1 product
Consul
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Consul
Before 1.22.0
Consul
Before 1.18.12
Consul
From 1.19.0 to 1.20.8
Consul
From 1.21.0 to 1.21.6

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.