HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. The flaw, classified as a resource exhaustion weakness (CWE‑770), can cause the agent process to consume excessive memory, leading to degraded performance or crashes. The impact is that services relying on a healthy Consul agent could be disrupted without the attacker needing any credentials.

The issue affects HashiCorp Consul Community Edition versions older than 2.1.0 and Consul Enterprise versions older than 2.1.0 or 1.21.19. Both CE and Enterprise clients and agents are susceptible when exposed to external HTTP API traffic.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the known exploitation likelihood remains uncertain. The attack vector is inferred to be unauthenticated HTTP requests to the API; the attacker must have network access to the Consul agent but does not require authentication, making it a potentially low‑barrier attack.