Consul Community Edition and Consul Enterprise versions from 1.13.0 through 2.0.2 allow an unauthenticated actor to open an arbitrary number of external gRPC connections. Each incomplete connection consumes a file descriptor, a goroutine, and a portion of memory, which can quickly exhaust the agent’s resources. The resulting denial of service manifests as legitimate clients being unable to establish connections, effectively disabling the Consul service for the affected nodes. The weakness is an uncontrolled resource consumption flaw identified as CWE‑770.

HashiCorp Consul Community Edition and HashiCorp Consul Enterprise from version 1.13.0 to 2.0.2 are affected. The problem is resolved in Consul 2.0.3 for the open‑source edition, and in Consul Enterprise 1.21.17, 1.22.11, and 2.0.3 for the enterprise edition.

The CVSS score of 7.5 signifies a high impact and medium to high difficulty of exploitation. EPSS data is not available, but the flaw can be activated from any network that can reach the external gRPC listener since no authentication is required. The likely attack vector is a remote passive connection to that listener, which an adversary can replay from any IP address. While the vulnerability does not expose data or enable code execution, it can completely halt availability of the Consul service. CISA has not listed it in the KEV catalog, although its severity warrants prompt remediation.