CVE-2025-11374
Medium · 6.5Consul key/value endpoint is vulnerable to denial of service
CVSS
6.5
EPSS
0.4%
Published
Oct 28, 2025
CISA due date
—
The record
Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/hashicorp/consul | 0 | 1.22.0 |
| Bitnami | consul | 0 | 1.22.0 |
| Chainguard | consul-1.18-oci-entrypoint | 0 | 1.18.2-r44 |
| Chainguard | consul-1.18-oci-entrypoint-compat | 0 | 1.18.2-r44 |
| Chainguard | consul-1.19-oci-entrypoint | 0 | 1.19.2-r43 |
| Chainguard | consul-1.19-oci-entrypoint-compat | 0 | 1.19.2-r43 |
| Chainguard | consul-1.20-oci-entrypoint | 0 | 1.20.6-r7 |
| Chainguard | consul-1.20-oci-entrypoint-compat | 0 | 1.20.6-r7 |
| Chainguard | consul-1.21-oci-entrypoint | 0 | 1.21.5-r2 |
| Chainguard | consul-1.21-oci-entrypoint-compat | 0 | 1.21.5-r2 |
| Chainguard | consul-1.22 | 0 | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint | 0 | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint-compat | 0 | 1.22.1-r2 |
| Chainguard | consul-fips-1.19-oci-entrypoint | 0 | 1.19.2-r42 |
| Chainguard | consul-fips-1.19-oci-entrypoint-compat | 0 | 1.19.2-r42 |
| Chainguard | consul-fips-1.20-oci-entrypoint | 0 | 1.20.6-r6 |
| Chainguard | consul-fips-1.20-oci-entrypoint-compat | 0 | 1.20.6-r6 |
| Chainguard | consul-fips-1.21-oci-entrypoint | 0 | 1.21.5-r2 |
| Chainguard | consul-fips-1.21-oci-entrypoint-compat | 0 | 1.21.5-r2 |
| Chainguard | consul-fips-1.22 | 0 | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint | 0 | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint-compat | 0 | 1.22.2-r1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0 | 0.0.20251105T184115-1.1 |
Related vulnerabilities
- GO-2025-4081 Consul key/value endpoint is vulnerable to denial of service in… Same vulnerability
- GO-2025-4082 Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul Also affects github.com/hashicorp/consul
- CVE-2025-11375 Consul event endpoint is vulnerable to denial of service Also affects github.com/hashicorp/consul
- CVE-2024-10086 A vulnerability was identified in Consul and Consul Enterprise such that the server… Also affects github.com/hashicorp/consul
- CVE-2024-10006 A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using… Also affects github.com/hashicorp/consul
- CVE-2024-10005 A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using… Also affects github.com/hashicorp/consul
- CVE-2025-65637 Logrus is vulnerable to DoS when using Entry.Writer() Also affects consul-1.18-oci-entrypoint
- CVE-2024-51744 golang-jwt is a Go implementation of JSON Web Tokens. Also affects consul-1.18-oci-entrypoint