CVE-2025-11375: Denial of Service Vulnerability in HashiCorp Consul Event Endpoint
Summary
CVE-2025-11375: Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul. Affects github.com/hashicorp/consul versions < 1.22.0. Fixed in 1.22.0. How to fix ↓
Also tracked for
- consul · Bitnami
The same CVE-2025-11375 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is a widely used tool for service discovery and infrastructure management. It provides features such as service health monitoring, key-value storage, and multi-datacenter support. However, it has been identified that the event endpoint of Consul is susceptible to a denial of service attack, which could disrupt its normal operations and affect services relying on it.
Vulnerability Detail
The vulnerability arises from the Consul event endpoint, which can be exploited to cause a denial of service. Attackers can send specially crafted requests that overwhelm the endpoint, leading to service unavailability. This issue is particularly concerning for applications that depend on Consul for service discovery and health checks, as it can lead to significant downtime and impact overall system reliability.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22.0
This is the first release that contains the fix.
go get github.com/hashicorp/consul@v1.22.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on the event endpoint to mitigate the risk of denial of service attacks. This can be done by configuring your reverse proxy or load balancer to limit the number of requests allowed from a single IP address within a specified timeframe.
Conclusion
The denial of service vulnerability identified in HashiCorp Consul's event endpoint poses a significant risk to applications relying on this tool. It is crucial to update to the patched version 1.22.0 to mitigate this risk. Additionally, implementing temporary workarounds such as rate limiting can help protect against potential exploits until the update is applied.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
The vulnerability is a denial of service issue that affects the event endpoint of HashiCorp Consul.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability can lead to service disruptions, affecting applications that rely on Consul for service discovery and health monitoring.
Yes, a patch is available in version 1.22.0 of HashiCorp Consul. It is recommended to update to this version or later.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the Gopkg.lock file. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
