hashicorp/consul v2.0.3

on GitHub

2.0.3 (August 7, 2026)

SECURITY:

• Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
• Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
• Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761]
• Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-23761]
• Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]
• Upgrade to use Go 1.26.5. This resolves vulnerabilities
  GO-2026-4970 (os).
  GO-2026-5856 (crypto/tls). [GH-23761]
• agent: Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots
  and POST /v1/agent/connect/authorize used the agent-side cache unconditionally, even
  when http_config { use_cache = false } was configured by the operator. A remote caller
  could bypass this setting and grow the agent cache without bound by varying the request
  ACL token. Both endpoints now skip the cache and issue a direct RPC when use_cache is
  disabled. (SECVULN-50292, SECVULN-50293) [GH-23797]
• agent: Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt
  when a service-router config entry contained a route with a nil Destination. A crafted
  snapshot restore or replication message containing such an entry could crash the FSM
  decode path. The nil guard now treats a missing destination as non-enterprise data and
  continues decoding safely. (SECVULN-50291) [GH-23797]
• agent: Fixed a security bypass where a user-supplied public listener
  (envoy_public_listener_json) with an HTTP Connection Manager filter would skip Consul's
  inbound request-normalization defaults. An attacker could exploit the un-normalized path
  to bypass L7 intention deny rules using percent-encoded path equivalents. Consul now
  injects path normalization (enabled by default, unless the mesh config option
  InsecureDisablePathNormalization is set) on every HCM filter chain in user-provided
  public listeners before L7 intention enforcement is applied. (SECVULN-50295) [GH-23797]
• agent: Fixed an unauthenticated denial-of-service vulnerability where
  PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register,
  PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize
  decoded unbounded JSON request bodies before resolving the caller's ACL
  token. An unauthenticated caller could retain multiple large JSON decoder
  buffers concurrently inside the Consul process before each request was
  rejected with HTTP 403, causing attacker-controlled heap growth. All four
  endpoints now cap the request body at 512 KiB before any decoding occurs,
  returning HTTP 413 for oversized bodies. This limit applies to chunked
  transfer encoding as well as declared Content-Length.
  (SECVULN-50418) [GH-23796]
• agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC
  and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP
  before any request processing, ACL check, or rate limiting could occur. A remote attacker
  could exhaust agent file descriptors, goroutines, and memory by opening many connections
  and withholding the gRPC or TLS handshake. A new per-client-IP connection limiter is now
  applied before the gRPC server observes the connection, controlled by the new
  limits.grpc_max_conns_per_client configuration option (default 100). The gRPC handshake
  timeout has also been reduced from the library default of 120 seconds to 20 seconds.
  (SECVULN-50294) [GH-23797]

IMPROVEMENTS:

• ui: migrate yadda/Gherkin acceptance tests to native QUnit (harness, intentions/create, components, settings) [GH-23741]
• xds: Add two new opt-in ProxyDefaults.spec.config keys for controlling the server response header on API Gateway HTTP listeners: envoy_suppress_envoy_headers (removes the header entirely) and envoy_server_header_name (renames it to a custom value). If both are set, suppress takes precedence. [GH-13027]

BUG FIXES:

• agent: Stop logging the raw ACL token in debug-level content-type logs. [GH-23731]
• api-gateway: Fixed a regression that caused an HTTP API gateway to reject its configuration with an "inconsistent protocols" error (resulting in intermittent 503s) when a backend service's service-router composed a route to a destination in a different service, namespace, or partition during discovery-chain synthesis. [GH-23793]
• serf: Fix WAN flood-join to ignore non-alive destination members (leaving/left/failed), allowing rejoined servers to heal back to alive in WAN membership. [GH-23709]
• xds: Addition of XFCC headers to GPRC request similar to HTTP request for connect-proxy inbound listener [GH-23744]