CVE-2026-15972
Last modified
CVE-2026-15972 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Consul | >= 1.13.0, < 2.0.3 |
| HashiCorp | Consul Enterprise | >= 1.13.0, < 2.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-15972?
How severe is CVE-2026-15972?
How do I fix CVE-2026-15972?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-15967Insufficient session expiration vulnerability in Progress MO…9.8
- CVE-2026-15968Improper neutralization of input during web page generation …5.4
- CVE-2026-15969SGLang contains an unauthenticated RCE in /load_lora_adapter…9.8
- CVE-2026-1597A vulnerability has been found in Bdtask SalesERP up to 2026…8.8
- CVE-2026-15970Consul Community Edition and Consul Enterprise 1.20.1 throug…4.2
- CVE-2026-15971SGLang contains an RCE vulnerability when the optional dumpe…9.8
- CVE-2026-15974SGLang contains an SSRF and local file read in the multimoda…6.5
- CVE-2026-15975GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
- CVE-2026-15976SGLang contains a RCE vulnerability when attempting to load …9.8
- CVE-2026-15977SGLang contains a credential leakage vulnerability in the /s…7.5
- CVE-2026-15978SGLang contains a model weight exfiltration vulnerability wh…7.5
- CVE-2026-15979The Content Egg – Affiliate Product Importer & Price Compari…8.1
Are you affected by CVE-2026-15972?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST