An uncontrolled resource consumption flaw exists within the Consul Connect authorization endpoint, allowing a caller to grow the agent’s intention‑match cache without bound. The vulnerability defeats the operator’s cache‑disable configuration and can lead to excessive memory or disk use, potentially causing the Consul agent to become unresponsive or crash. The weakness is a classic example of CWE‑770, Uncontrolled Resource Consumption.

HashiCorp Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 are affected. The issue has been fixed in Consul 2.0.3, and in Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

The CVSS score of 4.3 indicates a moderate severity assessment. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the Connect authorization endpoint, which may be reachable from the network or through external clients. An attacker with access to that endpoint can send repeated or specially crafted requests to expand the cache until the agent’s resources are exhausted. Because the flaw can be triggered with normal endpoint access and without privileged credentials, the exploitation difficulty is considered low to moderate. The risk is chiefly availability impact to the Consul agent, which can cascade to service disruptions in systems relying on Consul for service discovery and configuration.