hashicorp consul

Name: hashicorp consul
Brand: hashicorp

productUS

cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

critical

by severity

0critical20high13medium0low

updated 2026-10-28

vulnerabilities (35)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-41805US	high8.8OT high	34.8% (98th)	Exploit	1.8.17	2021-12-12	3 versions
CVE-2024-10005US	medium5.8	0.77% (55th)	Exploit	1.18.5	2024-10-30	5 versions
CVE-2022-29153US	high7.5	8.75% (95th)	—	1.9.17	2022-04-19	3 versions
CVE-2020-25864US	medium6.1	6.07% (93rd)	—	1.8.10	2021-04-20	3 versions
CVE-2021-3121US	high8.6	3.43% (89th)	—	1.10.2	2021-01-11	3 versions
CVE-2020-13250US	high7.5	2.92% (87th)	—	1.6.6	2020-06-11	2 versions
CVE-2020-25201US	high7.5	2.61% (85th)	—	no fix	2020-11-04	1.7.0 → 1.8.4
CVE-2021-28156US	high7.5	2.29% (83rd)	—	1.8.10	2021-04-20	2 versions
CVE-2020-7219US	high7.5	2.04% (81st)	—	1.6.2	2020-01-31	< 1.6.2
CVE-2020-13170US	high7.5	1.77% (78th)	—	1.6.6	2020-06-11	2 versions
CVE-2020-12758US	high7.5	1.71% (77th)	—	1.7.4	2020-06-11	2 versions
CVE-2021-36213US	high7.5	1.69% (77th)	—	1.9.8	2021-07-17	2 versions
CVE-2020-12797US	medium5.3	1.55% (75th)	—	1.7.4	2020-06-11	3 versions
CVE-2022-24687US	medium6.5	1.49% (74th)	—	1.9.15	2022-02-24	3 versions
CVE-2021-32574US	high7.5	1.46% (73rd)	—	1.9.8	2021-07-17	3 versions
CVE-2020-28053US	medium6.5OT elevated	1.45% (73rd)	—	1.6.10	2020-11-23	3 versions
CVE-2021-38698US	medium6.5OT elevated	1.42% (73rd)	—	1.10.2	2021-09-07	3 versions
CVE-2020-7955US	medium5.3OT elevated	1.41% (73rd)	—	1.6.2	2020-01-31	1.4.1 → 1.6.2
CVE-2019-8336US	high8.1	1.25% (69th)	—	1.4.3	2019-03-05	1.4.0 → 1.4.3
CVE-2018-19653US	medium5.9	1.22% (69th)	—	no fix	2018-12-09	0.5.1 → 1.4.0
CVE-2019-12291US	high7.5	1.16% (67th)	—	no fix	2019-06-06	1.4.0 → 1.5.0
CVE-2021-37219US	high8.8	1.15% (67th)	—	1.10.2	2021-09-07	3 versions
CVE-2022-40716US	medium6.5	1.09% (65th)	—	1.12.5	2022-09-23	3 versions
CVE-2021-41803US	high7.1OT elevated	1.07% (65th)	—	1.11.9	2022-09-23	3 versions
CVE-2023-0845US	medium6.5	1.00% (63rd)	—	1.14.5	2023-03-09	< 1.14.5
CVE-2023-5332US	high8.1	0.87% (59th)	—	1.0.8	2023-12-04	4 versions
CVE-2023-1297US	high7.5	0.77% (55th)	—	1.15.3	2023-06-02	2 versions
CVE-2022-3920US	high7.5OT elevated	0.72% (54th)	—	no fix	2022-11-16	1.13.0 → 1.13.3
CVE-2019-9764US	high7.4	0.61% (49th)	—	no fix	2019-03-26	= 1.4.3
CVE-2023-2816US	medium6.5	0.58% (48th)	—	1.15.3	2023-06-02	1.15.0 → 1.15.3
CVE-2024-10006US	medium5.8	0.47% (40th)	—	1.18.5	2024-10-30	5 versions
CVE-2023-3518US	high7.3	0.45% (39th)	—	no fix	2023-08-09	= 1.16.0
CVE-2025-11375US	—	0.43% (37th)	—	1.21.6	2025-10-28	4 versions
CVE-2025-11374US	—	0.43% (37th)	—	1.20.8	2025-10-28	4 versions
CVE-2024-10086US	medium6.1	0.40% (35th)	—	1.20.0	2024-10-30	4 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption4 CVEs
CWE-770Allocation of Resources Without Limits or Throttling4 CVEs
CWE-863Incorrect Authorization4 CVEs
CWE-862Missing Authorization3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-266Incorrect Privilege Assignment2 CVEs
CWE-284Improper Access Control2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE35 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan