PT-2025-44204 · Hashicorp+2 · Hashicorp Consul+3

Julien Ahrens · Published 2025-10-28 · Updated 2025-12-22 · CVE-2025-11375

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Consul versions prior to 1.22.0 Consul Enterprise versions prior to 1.22.0 Consul Enterprise version 1.21.6 Consul Enterprise version 1.20.8 Consul Enterprise version 1.18.12

Description The event endpoint in Consul and Consul Enterprise is susceptible to a denial of service (DoS) condition. This is caused by the absence of a maximum value restriction on the Content Length header. A malicious actor could potentially exploit this to disrupt service availability.

Recommendations Update Consul to version 1.22.0 or later. Update Consul Enterprise to version 1.22.0 or later. Update Consul Enterprise to version 1.21.6. Update Consul Enterprise to version 1.20.8. Update Consul Enterprise to version 1.18.12.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-15596

BDU:2025-15597

BIT-CONSUL-2025-11375

CVE-2025-11375

GHSA-QH7P-PFQ3-677H

GO-2025-4082

OPENSUSE-SU-2025:15710-1

Affected Products

Hashicorp Consul

Hashicorp Consul Enterprise

Debian

Red Os

References · 98

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11375 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11375 · Security Note
• https://osv.dev/vulnerability/BIT-consul-2025-11375 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4082 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15596 · Security Note
• https://bdu.fstec.ru/vul/2025-15597 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11375 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11375 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh7p-pfq3-677h · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11375 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11375 · Security Note
• https://github.com/hashicorp/consul · Note