Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 contain an unauthenticated denial‑of‑service vulnerability that manifests when certain agent HTTP API endpoints process request bodies without enforcing size limits. By sending a request with an unbounded body, a remote attacker can cause the agent to allocate a large amount of memory before the request is rejected, leading to resource exhaustion and potential service disruption. The weakness is a classic example of memory‑management failure and is classified as CWE-400.

The vulnerability affects HashiCorp Consul Community Edition and Consul Enterprise. All releases from 1.3.0 to 2.0.2 are vulnerable; the bug is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

The CVSS score of 5.3 reflects a moderate severity due to the lack of authentication requirement, but the impact is limited to service availability rather than data compromise. EPSS data is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector is remote unauthenticated traffic targeting the agent HTTP API, with the attacker provoking memory consumption via specially crafted request bodies. Successful exploitation would result in denial of service on the target node, potentially cascading to cluster disruption if multiple agents are affected.