CVE-2020-13250 json
Allocation of Resources Without Limits or Throttling in Hashicorp Consul
published 2020-06-11 6 y ago modified 2026-09-08 2 mo ago also BIT-consul-2020-13250 , EUVD-2021-1185 , GHSA-rqjq-mrgx-85hp , GO-2022-0879
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Patch / fix
- go github.com/hashicorp/consul 1.6.6, 1.7.4
- bitnami consul 1.6.6, 1.7.4
- hashicorp consul 1.6.6, 1.7.4
- consul Debian 11 1.7.4+dfsg1-1
debian advisories DEBIAN-CVE-2020-13250
- github.com/hashicorp/consul@72f92ae commit
- github.com/hashicorp/consul#8023 pull request
Exploit prediction
2.92% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/hashicorp/consul | >=1.2.0, <1.6.6 >=1.7.0, <1.7.4 |
1.6.6 1.7.4 |
| bitnami | consul | >=1.2.0, <1.6.6 >=1.7.0, <1.7.4 |
1.6.6 1.7.4 |
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
References
-
github.com
/hashicorp/consul/pull/8023
web, patch, third-party-advisory, advisory
-
github.com
/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432
web, patch
-
github.com
/hashicorp/consul/blob/v1.6.6/CHANGELOG.md
web, release-notes, third-party-advisory, advisory
-
github.com
/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
web, release-notes, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13250
advisory, web
-
github.com
/advisories/GHSA-rqjq-mrgx-85hp
advisory
Sources
- CVE List CVE-2020-13250
- GitHub Advisory GHSA-rqjq-mrgx-85hp
- NVD CVE-2020-13250
- OSV BIT-consul-2020-13250
- OSV GO-2022-0879
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.