Allocation of Resources Without Limits or Throttling
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.
Advisories for Golang/Github.com/Hashicorp/Consul/Agent/Consul package
2021
2020
Incorrect Permission Assignment for Critical Resource
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers.
Improper Resource Shutdown or Release
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry.