{"id":"CVE-2020-13250","aliases":["BIT-consul-2020-13250","DEBIAN-CVE-2020-13250","EUVD-2021-1185","GHSA-rqjq-mrgx-85hp","GO-2022-0879","UBUNTU-CVE-2020-13250"],"status":"published","title":"Allocation of Resources Without Limits or Throttling in Hashicorp Consul","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02923,"percentile":0.87223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2020-06-11T19:16:12Z","modified":"2026-10-20T10:51:11Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","fixed_in":["1.6.6","1.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"consul","fixed_in":["1.6.6","1.7.4"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"consul","fixed_in":["1.7.4+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.6.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.6.6"},{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.6.6"},{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7~dfsg1-5ubuntu1","1.4.4~dfsg1-2ubuntu2","1.5.2+dfsg1-6","1.5.2+dfsg1-10","1.5.2+dfsg1-12","1.5.2+dfsg2-14"]}],"products":[{"vendor":"hashicorp","product":"consul"}],"references":[{"url":"https://github.com/hashicorp/consul/pull/8023","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13250","tags":["web","advisory"]},{"url":"https://github.com/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-rqjq-mrgx-85hp","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13250","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13250","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13250","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T19:16:12Z","modified":"2024-08-04T12:11:19.467Z","updated_at":"2026-11-02T14:35:53.868619Z"}],"euvd":[{"id":"EUVD-2021-1185","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T19:16:12Z","modified":"2024-08-04T12:11:19Z","updated_at":"2026-11-03T03:07:38.311662Z"}],"ghsa":[{"id":"GHSA-rqjq-mrgx-85hp","title":"Allocation of Resources Without Limits or Throttling in Hashicorp Consul","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service.\n\n### Specific Go Packages Affected\ngithub.com/hashicorp/consul/agent/config\n\n### Fix\nThe vulnerability is fixed in versions 1.6.6 and 1.7.4.","status":"published","published":"2021-05-18T18:21:35Z","modified":"2023-10-02T14:01:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:37:07.641671Z"}],"nvd":[{"id":"CVE-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T20:15:11.477Z","modified":"2026-06-17T02:52:47.793Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"CVE-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T20:15:11.477Z","modified":"2026-10-20T10:51:11.106657853Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T20:15:11.477Z","modified":"2026-08-27T13:02:33.00698043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"GHSA-rqjq-mrgx-85hp","title":"Allocation of Resources Without Limits or Throttling in Hashicorp Consul","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service.\n\n### Specific Go Packages Affected\ngithub.com/hashicorp/consul/agent/config\n\n### Fix\nThe vulnerability is fixed in versions 1.6.6 and 1.7.4.","status":"published","published":"2021-05-18T18:21:35Z","modified":"2024-08-21T15:58:49.598835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2020-06-11T20:15:00Z","modified":"2025-10-24T04:48:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"BIT-consul-2020-13250","description":"HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.","status":"published","published":"2024-03-06T10:54:43.689Z","modified":"2026-09-08T08:45:59.904514618Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"GO-2022-0879","title":"Allocation of Resources Without Limits or Throttling in Hashicorp Consul in github.com/hashicorp/consul","description":"Allocation of Resources Without Limits or Throttling in Hashicorp Consul in github.com/hashicorp/consul","status":"published","published":"2024-08-21T15:29:06Z","modified":"2026-03-03T04:52:21.585199Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}