CVE-2020-7219: Denial of Service (DoS) in HashiCorp Consul
Summary
CVE-2020-7219: Denial of Service (DoS) in HashiCorp Consul. Affects github.com/hashicorp/consul versions < 1.6.3. Fixed in 1.6.3. How to fix ↓
Also tracked for
The same CVE-2020-7219 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
HashiCorp Consul is a service mesh solution that provides a distributed and highly available network infrastructure for applications. It offers features such as service discovery, health checking, and key-value storage. Consul is implemented in Go and is widely used in production environments. However, versions up to 1.6.2 of Consul and Consul Enterprise were found to have a vulnerability that allowed unbounded resource usage and were susceptible to unauthenticated denial of service attacks.
Vulnerability Detail
The vulnerability in HashiCorp Consul and Consul Enterprise up to version 1.6.2 allowed unbounded resource usage and could be exploited to launch unauthenticated denial of service attacks. This means that an attacker could send specially crafted requests to the HTTP/RPC services of Consul, causing excessive resource consumption and potentially leading to service disruption. The vulnerability has been assigned CVE-2020-7219 and has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: v1.22.7 as of 22 Oct 2026
go get github.com/hashicorp/consul@v1.22.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.3
This is the first release that contains the fix.
go get github.com/hashicorp/consul@v1.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise up to version 1.6.2 allows unbounded resource usage and can be exploited to launch unauthenticated denial of service attacks. It is crucial to upgrade to version 1.6.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/consul →
FAQ
HashiCorp Consul is a service mesh solution that provides a distributed and highly available network infrastructure for applications. It offers features such as service discovery, health checking, and key-value storage.
The vulnerability allows unbounded resource usage and can be exploited to launch unauthenticated denial of service attacks. This can lead to excessive resource consumption and potential service disruption.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
To fix this vulnerability, it is recommended to upgrade to version 1.6.3 or later of HashiCorp Consul. This version includes the necessary patches to mitigate the denial of service vulnerability.
You can find more information about this vulnerability in the CVE-2020-7219 entry or by visiting the HashiCorp Consul GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/consul.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
