CVE-2023-1297

highpriority · track · 30EPSS 0.008 · 55 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.77% (55th) EPSS

CVSS 7.5 · high

Is it mine?

13 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hsecondary · security@hashicorp.comexploitability 1.2 · impact 3.6

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-826USCWE-826USCWE-826US

affected products (13)

Products and version ranges known to be affected.

Consul≤ 1.15.0 ≤1.15.3enisa_euvdEU
Consul≤ 1.14.0 ≤1.14.5enisa_euvdEU
Consul Enterprise≤ 1.15.0 ≤1.15.3enisa_euvdEU
Consul Enterprise≤ 1.14.0 ≤1.14.5enisa_euvdEU
Hashicorp Consul1.13.0 → 1.14.7fstec_bduRU
Hashicorp Consul1.15.0 → 1.15.3fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
hashicorp consul1.13.0 → 1.14.7nvdUScpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*
hashicorp consul1.15.0 → 1.15.3nvdUScpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*
Bitnami consul1.13.0 → 1.14.7osvUSpkg:bitnami/consul
Bitnami consul1.15.0 → 1.15.3osvUSpkg:bitnami/consul
Go github.com/hashicorp/consul< 1.14.5osvUSpkg:golang/github.com/hashicorp/consul
Go github.com/hashicorp/consul1.15.0 → 1.15.3osvUSpkg:golang/github.com/hashicorp/consul

advisories (3)

Vendor and ecosystem advisories describing this.

GHSA-c57c-7hrj-6q6vHashicorp Consul vulnerable to denial of service2023-06-03ghsa · osvUS
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
BIT-consul-2023-1297 Consul Cluster Peering can Result in Denial of Service2024-03-06vendor · osvUS
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
GO-2023-1827Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul2024-08-20vendor · osvUS
Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv nvd NVD CVE.org MITRE

published 2023-06-02modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan