Consul's KV endpoint is vulnerable to denial of service (CVE-2025-11374)

Summary

Consul's KV endpoint is vulnerable to denial of service

Original description

The description as published by the source.

Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header validation. This vulnerability, CVE-2025-11374, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami consul

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.22.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2025-11374 consul

References

advisory discuss.hashicorp.com
web nvd.nist.gov