{"id":"CVE-2022-29153","aliases":["BIT-consul-2022-29153","DEBIAN-CVE-2022-29153","EUVD-2022-1808","GHSA-q6h7-4qgw-2j9p","GO-2022-0615","MGASA-2023-0009","UBUNTU-CVE-2022-29153"],"status":"published","title":"Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08746,"percentile":0.95193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-918"],"published":"2022-04-19T00:00:00Z","modified":"2026-10-28T10:28:41Z","exploits":[{"source":"nuclei","id":"CVE-2022-29153","title":"HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29153.yaml"}],"fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","fixed_in":["1.9.17","1.10.10","1.11.5"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"consul","fixed_in":["1.9.17","1.10.10","1.11.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.17"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"consul","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"},{"introduced":"1.10.0"},{"fixed":"1.10.10"},{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.12+dfsg1-1","1.8.7+dfsg1-2","1.8.7+dfsg1-3","1.8.7+dfsg1-4","1.8.7+dfsg1-5","1.8.7+dfsg1-6","1.9.17+dfsg2-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.10.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/consul","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"},{"introduced":"1.10.0"},{"fixed":"1.10.10"},{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.22-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4~dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.7~dfsg1-5ubuntu1","1.4.4~dfsg1-2ubuntu2","1.5.2+dfsg1-6","1.5.2+dfsg1-10","1.5.2+dfsg1-12","1.5.2+dfsg2-14"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"consul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.4+dfsg1-1","1.8.7+dfsg1-3"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"hashicorp","product":"consul"}],"references":[{"url":"https://discuss.hashicorp.com","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393","tags":["x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20220602-0005/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29153","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/"},{"url":"https://github.com/advisories/GHSA-q6h7-4qgw-2j9p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29153.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-29153","tags":["advisory"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery","tags":["web"]},{"url":"https://github.com/hashicorp/consul","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220602-0005","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0009.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30834","tags":["report"]},{"url":"https://docs.docker.com/engine/release-notes/#201018","tags":["web"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ/","tags":["web"]},{"url":"https://docs.docker.com/engine/release-notes/#201020","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VFYXCTLOSESYIP72BUYD6ECDIMUM4WMB/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-29153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-29153","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T00:00:00Z","modified":"2024-08-03T06:10:59.268Z","updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-1808","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T00:00:00Z","modified":"2024-08-03T06:10:59Z","updated_at":"2026-11-03T03:25:39.28463Z"}],"ghsa":[{"id":"GHSA-q6h7-4qgw-2j9p","title":"Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector","description":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-20T00:00:33Z","modified":"2023-01-27T05:02:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:36:19.144959Z"}],"nvd":[{"id":"CVE-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T16:17:10.493Z","modified":"2026-06-17T04:39:41.673Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"DEBIAN-CVE-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T16:17:10.493Z","modified":"2026-08-27T23:04:21.094250595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:36.969609Z"},{"id":"GHSA-q6h7-4qgw-2j9p","title":"Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector","description":"A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-20T00:00:33Z","modified":"2026-09-10T03:49:36.686114722Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T16:17:00Z","modified":"2025-10-24T04:53:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-consul-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2024-03-06T10:52:10.905Z","modified":"2026-09-08T08:46:00.252189897Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"CVE-2022-29153","description":"HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.","status":"published","published":"2022-04-19T00:00:00Z","modified":"2026-10-28T10:28:41.623781655Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"GO-2022-0615","title":"Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul","description":"Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul","status":"published","published":"2024-08-21T15:11:40Z","modified":"2026-02-04T03:41:28.299846Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2023-0009","title":"Updated docker packages fix security vulnerability","description":"Server side request forgery (CVE-2022-29153)\n\nBypass primary group restrictions due to a flaw in the supplementary group\naccess setup (CVE-2022-36109)\n\nImported Nodes/Services Information leak in moby-engine. (CVE-2022-3920)\n","status":"published","published":"2023-01-24T07:58:24Z","modified":"2026-04-16T04:40:41.815741113Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}