Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 are vulnerable because the Connect CA roots endpoint allows a remote caller to grow the agent's Connect CA roots cache without limit. This uncontrolled resource consumption can lead to excessive memory usage that may crash or degrade the Consul agent, effectively causing a denial of service. The weakness is identified as CWE‑770.

Affected products are HashiCorp Consul Community Edition and Consul Enterprise. Vulnerable releases include community editions from 1.2.0 to 2.0.2 and Enterprise editions up to 2.0.2. Fixes are available in Community 2.0.3 and Enterprise 1.21.17, 1.22.11, and 2.0.3.

The CVSS score of 5.3 indicates moderate severity. EPSS score is not available, and the vulnerability is not listed in CISA KEV, so current exploitation likelihood is uncertain. Attackers can exploit the endpoint remotely, with no special privileges, by repeatedly requesting the CA roots endpoint, causing the cache to grow until resources are exhausted. The impact is a service disruption that affects all agents using the vulnerable firmware. Prompt patching is recommended because unbounded cache growth can compromise system stability.