PT-2025-44211 · Hashicorp+2 · Hashicorp Consul+3

Julien Ahrens · Published 2025-10-28 · Updated 2025-12-22 · CVE-2025-11374

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Consul versions prior to 1.22.0 Consul Enterprise versions prior to 1.22.0 Consul Enterprise version 1.21.6 Consul Enterprise version 1.20.8 Consul Enterprise version 1.18.12

Description The key/value endpoint in Consul and Consul Enterprise is susceptible to a denial of service (DoS) condition. This is caused by improper validation of the Content Length header.

Recommendations Update to Consul Community Edition 1.22.0 or later. Update to Consul Enterprise 1.22.0 or later. Update to Consul Enterprise 1.21.6. Update to Consul Enterprise 1.20.8. Update to Consul Enterprise 1.18.12.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-15597

BIT-CONSUL-2025-11374

CVE-2025-11374

GHSA-7G3R-8C6V-HFMR

GO-2025-4081

OPENSUSE-SU-2025:15710-1

Affected Products

Hashicorp Consul

Hashicorp Consul Enterprise

Debian

Red Os

References · 95

• https://security-tracker.debian.org/tracker/CVE-2025-11374 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4081 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2025-11374 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-29-consuls-kv-endpoint-is-vulnerable-to-denial-of-service/76724 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11374 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-11374 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11374 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-11374 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11374 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g3r-8c6v-hfmr · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15597 · Security Note
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/commit/72a358cd02533477536ad4bd2b781f520fa7fac6 · Note