The vulnerability is a flaw in Consul’s key/value store HTTP handling. An attacker can exploit the incorrect validation of the Content‑Length header when sending requests to the KV endpoint, causing the Consul daemon to consume excessive memory and become unresponsive. This results in an availability loss for services that rely on Consul’s data plane and is classified as CWE‑770, Large or Uncontrolled Resource Consumption.

HashiCorp Consul Community Edition versions up to 1.21.9 and Consul Enterprise versions up to 1.21.5, 1.20.7 and 1.18.11 are affected. The fix is included in Community Edition 1.22.0 and Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1% shows that exploitation attempts are currently rare, and the vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack vector is network‑based: an attacker must reach the KV API over HTTP or HTTPS and craft a request with a mismatched Content‑Length header. The exploit is straightforward for anyone with network access to the service, so systems without proper segmentation may be at higher risk.