PT-2026-69121

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.2.0 through 2.0.2 Consul Enterprise versions 1.2.0 through 2.0.2 Description An uncontrolled resource consumption issue exists in the Connect CA roots endpoint. This allows a remote caller to expand the...

CVE-2026-19015: Allocation of Resources Without Limits or Throttling

Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable...

CVE-2026-19014: Allocation of Resources Without Limits or Throttling

Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect authorization endpoint that may allow a caller to grow the agent's intention-match cache without bound, defeating the operator's cache-disable...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

EUVD-2025-210649

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

CVE-2026-19017: Missing Authorization

Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with operator:write permission may direct Consul to read and forward...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

PT-2026-69120

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.17.0 through 2.0.2 Consul Enterprise versions 1.17.0 through 2.0.2 Description An uncontrolled resource consumption issue exists in the Connect authorization endpoint. This flaw allows a caller to expand the...

PT-2026-69139

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description Improper access controls exist within the MCP enabledTools Scope Handler component. The issue resides in the connect mcp servers function located in the nanobot/agent/tools/mcp.py file. This fl...

CVE-2025-63235

In sol commit 373d848 2024-12-12, the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK...

CVE-2025-63235

The sol broker (specifically in commit 373d848) fails to fully release resources when handling malformed or duplicate CONNECT packets . When clients send invalid packets—due to failed authentication or repeated attempts—the server may drop the connection or send a CONNACK without deallocating int...

PT-2026-69123

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.18.21 through 2.0.2 Consul Enterprise versions 1.18.21 through 2.0.2 Description An issue exists when the software is configured to use the Vault Connect CA provider with JWT or AppRole authentication. A...

PT-2026-69332

CVE-2026-19014 - Uncontrolled resource consumption in the Consul Connect authorization endpoint CVE ID :CVE-2026-19014 Published : Aug. 7, 2026, 7:19 p.m. | 53 minutes ago Description :Consul Community Edition and Consul Enterprise 1.17.0 through 2.0.2 are vulnerable to an uncontrolled resource...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

Malicious code in connect-contingency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a03c555705f2bfa2e63b96e9ea5740196d1ea5ca8be0f1acce290c771f01ea [email protected] is a hollow package whose index.js is an empty stub. Its package.json declares its sole dependency ltidisafe as a direct...

GHSA-3CCP-42PG-HGV6 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

CVE-2026-71324

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...