CVE-2022-24687: Hashicorp Consul

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.

Affected products

• Hashicorp Consul: from 1.8.0, before 1.9.15 (fixed in 1.9.15); from 1.10.0, before 1.10.8 (fixed in 1.10.8); from 1.11.0, before 1.11.3 (fixed in 1.11.3)

Published 2022-02-24. Last modified 2026-06-17.