CVEvulnerability
CVE-2020-13250
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-770
Description
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Affected configurations
• hashicorp consul (>= 1.2.0 < 1.6.6)
• hashicorp consul (>= 1.7.0 < 1.7.4)
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md Release Notes, Third Party Advisory
- https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md Release Notes, Third Party Advisory
- https://github.com/hashicorp/consul/pull/8023 Patch, Third Party Advisory
- https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md Release Notes, Third Party Advisory
- https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md Release Notes, Third Party Advisory
- https://github.com/hashicorp/consul/pull/8023 Patch, Third Party Advisory