CVE-2026-19012 is an authenticated denial of service vulnerability affecting Consul Community Edition and Consul Enterprise versions from 1.18.0 up to but not including 2.0.3. The flaw exists in the downgrade path from Enterprise to Community Edition, where a caller with config-entry write permission can submit a malicious service-router configuration entry that causes the Consul agent process to exit unexpectedly, resulting in a denial of service condition. The vulnerability is addressed by official fixes in Consul 2.0.3 and specific Enterprise versions 1.21.17, 1.22.11, and 2.0.3.

An authorized user with config-entry write permissions can cause the Consul server to crash by submitting a crafted configuration entry, resulting in denial of service. This disrupts the availability of the Consul service until recovery or restart. There is no indication of privilege escalation or data compromise from the provided information.

A fix is available and should be applied. Users should upgrade to Consul 2.0.3 or later, or Consul Enterprise versions 1.21.17, 1.22.11, or 2.0.3 as appropriate. No additional mitigation steps are indicated by the vendor advisory.