CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2022-24687
Medium (6.5) in hashicorp consul. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/consul 1.10.8, 1.11.3, 1.9.15.
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-11-01)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:consul
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hj93-5fg3-3chr | Go | github.com/hashicorp/consul | >=1.8.0 <1.9.15 | 1.9.15 |
| GHSA-hj93-5fg3-3chr | Go | github.com/hashicorp/consul | >=1.10.0 <1.10.8 | 1.10.8 |
| GHSA-hj93-5fg3-3chr | Go | github.com/hashicorp/consul | >=1.11.0 <1.11.3 | 1.11.3 |
| GO-2022-0953 | Go | github.com/hashicorp/consul | >=1.8.0 <1.9.15 >=1.10.0 <1.10.8 >=1.11.0 <1.11.3 | 1.9.15, 1.10.8, 1.11.3 |