DEBIAN-CVE-2026-15972

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplet...

CVE-2026-19015

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

UBUNTU-CVE-2026-19015

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19014

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

UBUNTU-CVE-2026-19014

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

EUVD-2026-54644

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

CVE-2026-19015

CVE-2026-19015 concerns an uncontrolled resource consumption in the Consul Connect CA roots endpoint. Affected releases: Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2. A remote attacker could cause the agent to grow its Connect CA roots cache without bound, defeating the oper...

CVE-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19015 Uncontrolled resource consumption in the Consul Connect CA roots endpoint

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

EUVD-2026-54608

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19015

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19014

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19014

Removed by vendor...

CVE-2026-19014

CVE-2026-19014 affects Consul Community Edition and Consul Enterprise 1.17.0–2.0.2, where an uncontrolled resource consumption in the Connect authorization endpoint can grow the agent’s intention-match cache beyond bounds, bypassing cache-disable settings. Fixed in Consul 2.0.3 and Consul Enterpr...

CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2026-19014 Uncontrolled resource consumption in the Consul Connect authorization endpoint

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

UBUNTU-CVE-2026-71852

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

CVE-2026-71852

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

Multiple vulnerabilities impacting HashiCorp Consul

Summary Consul Community Edition and Consul Enterprise are affected by eight vulnerabilities. CVE-2026-19012 is an authenticated denial of service in the Enterprise-to-Community Edition downgrade path. CVE-2026-19014 is an uncontrolled resource consumption issue in the Connect authorization...