{"id":"EUVD-2025-36561","enisaUuid":"77cb6c3f-72ab-387d-88c0-622885994ea8","description":"Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.","datePublished":"Oct 28, 2025, 8:12:14 PM","dateUpdated":"Dec 9, 2025, 1:37:57 AM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723\n","aliases":"CVE-2025-11375\nGHSA-qh7p-pfq3-677h\n","assigner":"HashiCorp","epss":0.43,"enisaIdProduct":[{"id":"09659e4b-507e-37b0-8c49-e9625a201826","product":{"name":"Consul Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.22.0"},{"id":"d15ff0e6-f180-3dcc-9534-64b24d6c69be","product":{"name":"Consul","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.22.0"}],"enisaIdVendor":[{"id":"8115641c-e024-3de6-918c-e43b1643f535","vendor":{"name":"Hashicorp"}}],"enisaIdVulnerability":[{"id":"178125b0-57e8-3b9f-9be2-735930a8c09a","vulnerability":{"id":"GHSA-qh7p-pfq3-677h","description":"Consul event endpoint is vulnerable to denial of service","datePublished":"Oct 28, 2025, 9:30:33 PM","dateUpdated":"Nov 5, 2025, 10:12:37 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-11375\nhttps://github.com/hashicorp/consul/pull/22836\nhttps://github.com/hashicorp/consul/commit/e794201d0c618333d81ad775270f7b32801178fb\nhttps://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723\nhttps://github.com/hashicorp/consul\nhttps://github.com/hashicorp/consul/releases/tag/v1.22.0\nhttps://pkg.go.dev/vuln/GO-2025-4082\n","enisa_id":"EUVD-2025-36561\n","aliases":"GHSA-qh7p-pfq3-677h\nCVE-2025-11375\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:53:55 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ea934278-e6ad-3cd2-ab52-27232103de34","vulnerability":{"id":"CVE-2025-11375","description":"Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.","datePublished":"Oct 28, 2025, 8:12:14 PM","dateUpdated":"Dec 9, 2025, 1:37:57 AM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://discuss.hashicorp.com/t/hcsec-2025-28-consuls-event-endpoint-is-vulnerable-to-denial-of-service/76723\n","enisa_id":"EUVD-2025-36561\n","assigner":"HashiCorp","epss":0.43,"dataProcessed":"Nov 8, 2026, 7:16:19 AM","vulnerabilityProduct":[{"id":"5a6463d1-1561-3a33-a873-ed13cfe04cc7","product":{"name":"Consul Enterprise","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.22.0"},{"id":"5bbe30ad-c539-302b-9869-db8c2f878120","product":{"name":"Consul","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.22.0"}],"vulnerabilityVendor":[{"id":"2097bbdb-49e1-36a0-9551-3e9ea8885a85","vendor":{"name":"Hashicorp"}}]}}],"enisaIdAdvisory":[{"id":"5b267f5f-7f42-3734-bcd7-cef93b7f8ef1","advisory":{"id":"openSUSE-SU-2025:15710-1","description":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20251105T184115-1.1 on GA media","datePublished":"Nov 7, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:44:36 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15710-1.json\nhttps://www.suse.com/security/cve/CVE-2016-11063/\nhttps://www.suse.com/security/cve/CVE-2016-11066/\nhttps://www.suse.com/security/cve/CVE-2016-11067/\nhttps://www.suse.com/security/cve/CVE-2016-11068/\nhttps://www.suse.com/security/cve/CVE-2016-11069/\nhttps://www.suse.com/security/cve/CVE-2016-11070/\nhttps://www.suse.com/security/cve/CVE-2016-11071/\nhttps://www.suse.com/security/cve/CVE-2016-11072/\nhttps://www.suse.com/security/cve/CVE-2016-11073/\nhttps://www.suse.com/security/cve/CVE-2016-11074/\nhttps://www.suse.com/security/cve/CVE-2016-11075/\nhttps://www.suse.com/security/cve/CVE-2016-11076/\nhttps://www.suse.com/security/cve/CVE-2016-11077/\nhttps://www.suse.com/security/cve/CVE-2016-11078/\nhttps://www.suse.com/security/cve/CVE-2016-11079/\nhttps://www.suse.com/security/cve/CVE-2016-11080/\nhttps://www.suse.com/security/cve/CVE-2016-11081/\nhttps://www.suse.com/security/cve/CVE-2016-11082/\nhttps://www.suse.com/security/cve/CVE-2016-11083/\nhttps://www.suse.com/security/cve/CVE-2016-11084/\nhttps://www.suse.com/security/cve/CVE-2017-18872/\nhttps://www.suse.com/security/cve/CVE-2023-32199/\nhttps://www.suse.com/security/cve/CVE-2024-58269/\nhttps://www.suse.com/security/cve/CVE-2025-10545/\nhttps://www.suse.com/security/cve/CVE-2025-10678/\nhttps://www.suse.com/security/cve/CVE-2025-10954/\nhttps://www.suse.com/security/cve/CVE-2025-11374/\nhttps://www.suse.com/security/cve/CVE-2025-11375/\nhttps://www.suse.com/security/cve/CVE-2025-11579/\nhttps://www.suse.com/security/cve/CVE-2025-11621/\nhttps://www.suse.com/security/cve/CVE-2025-12044/\nhttps://www.suse.com/security/cve/CVE-2025-26625/\nhttps://www.suse.com/security/cve/CVE-2025-27093/\nhttps://www.suse.com/security/cve/CVE-2025-41410/\nhttps://www.suse.com/security/cve/CVE-2025-41443/\nhttps://www.suse.com/security/cve/CVE-2025-54286/\nhttps://www.suse.com/security/cve/CVE-2025-54287/\nhttps://www.suse.com/security/cve/CVE-2025-54288/\nhttps://www.suse.com/security/cve/CVE-2025-54289/\nhttps://www.suse.com/security/cve/CVE-2025-54290/\nhttps://www.suse.com/security/cve/CVE-2025-54291/\nhttps://www.suse.com/security/cve/CVE-2025-54293/\nhttps://www.suse.com/security/cve/CVE-2025-54469/\nhttps://www.suse.com/security/cve/CVE-2025-54470/\nhttps://www.suse.com/security/cve/CVE-2025-54471/\nhttps://www.suse.com/security/cve/CVE-2025-54499/\nhttps://www.suse.com/security/cve/CVE-2025-58073/\nhttps://www.suse.com/security/cve/CVE-2025-58075/\nhttps://www.suse.com/security/cve/CVE-2025-58356/\nhttps://www.suse.com/security/cve/CVE-2025-59043/\nhttps://www.suse.com/security/cve/CVE-2025-59048/\nhttps://www.suse.com/security/cve/CVE-2025-59530/\nhttps://www.suse.com/security/cve/CVE-2025-59836/\nhttps://www.suse.com/security/cve/CVE-2025-59937/\nhttps://www.suse.com/security/cve/CVE-2025-61141/\nhttps://www.suse.com/security/cve/CVE-2025-61524/\nhttps://www.suse.com/security/cve/CVE-2025-61581/\nhttps://www.suse.com/security/cve/CVE-2025-61688/\nhttps://www.suse.com/security/cve/CVE-2025-62156/\nhttps://www.suse.com/security/cve/CVE-2025-62157/\nhttps://www.suse.com/security/cve/CVE-2025-62375/\nhttps://www.suse.com/security/cve/CVE-2025-62506/\nhttps://www.suse.com/security/cve/CVE-2025-62513/\nhttps://www.suse.com/security/cve/CVE-2025-62705/\nhttps://www.suse.com/security/cve/CVE-2025-62714/\nhttps://www.suse.com/security/cve/CVE-2025-62725/\nhttps://www.suse.com/security/cve/CVE-2025-62820/\nhttps://www.suse.com/security/cve/CVE-2025-64101/\nhttps://www.suse.com/security/cve/CVE-2025-64102/\nhttps://www.suse.com/security/cve/CVE-2025-64103/\n","aliases":"CVE-2016-11063\nCVE-2016-11066\nCVE-2016-11067\nCVE-2016-11068\nCVE-2016-11069\nCVE-2016-11070\nCVE-2016-11071\nCVE-2016-11072\nCVE-2016-11073\nCVE-2016-11074\nCVE-2016-11075\nCVE-2016-11076\nCVE-2016-11077\nCVE-2016-11078\nCVE-2016-11079\nCVE-2016-11080\nCVE-2016-11081\nCVE-2016-11082\nCVE-2016-11083\nCVE-2016-11084\nCVE-2017-18872\nCVE-2023-32199\nCVE-2024-58269\nCVE-2025-10545\nCVE-2025-10678\nCVE-2025-10954\nCVE-2025-11374\nCVE-2025-11375\nCVE-2025-11579\nCVE-2025-11621\nCVE-2025-12044\nCVE-2025-26625\nCVE-2025-27093\nCVE-2025-41410\nCVE-2025-41443\nCVE-2025-54286\nCVE-2025-54287\nCVE-2025-54288\nCVE-2025-54289\nCVE-2025-54290\nCVE-2025-54291\nCVE-2025-54293\nCVE-2025-54469\nCVE-2025-54470\nCVE-2025-54471\nCVE-2025-54499\nCVE-2025-58073\nCVE-2025-58075\nCVE-2025-58356\nCVE-2025-59043\nCVE-2025-59048\nCVE-2025-59530\nCVE-2025-59836\nCVE-2025-59937\nCVE-2025-61141\nCVE-2025-61524\nCVE-2025-61581\nCVE-2025-61688\nCVE-2025-62156\nCVE-2025-62157\nCVE-2025-62375\nCVE-2025-62506\nCVE-2025-62513\nCVE-2025-62705\nCVE-2025-62714\nCVE-2025-62725\nCVE-2025-62820\nCVE-2025-64101\nCVE-2025-64102\nCVE-2025-64103\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1a23be4f-881a-3b69-af30-f47e7bd822db","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2ed33f7b-f8d3-3670-bc12-20339a40cad4","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3ff168c0-43f0-3e6a-a46b-90f0b9322304","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"6b082ef7-48e6-329d-a108-2122d2ee3fe7","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6df9e33c-98f3-3e85-bd98-4153a1025f74","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70fcae35-efbf-33bd-b653-2c72a0a85d73","product":{"name":"govulncheck-vulndb-0:0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"73a13c93-e86b-3658-97c0-52e119937024","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"dc8dabed-45c9-3497-b3f5-b41e45657724","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"eb1e91f2-e5cf-3808-8f1f-c394962ed62d","product":{"name":"govulncheck-vulndb-0.0.20251105T184115-1.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}