CVE-2026-19014 is a resource consumption vulnerability in HashiCorp Consul Community Edition and Enterprise versions 1.17.0 through 2.0.2. The flaw exists in the Connect authorization endpoint, where a caller can cause the agent's intention-match cache to grow without bounds, effectively defeating the operator's cache-disable setting. This uncontrolled resource allocation can lead to denial of service conditions due to resource exhaustion. The vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling). The issue is resolved in Consul 2.0.3 and specified Enterprise versions.

The vulnerability allows an attacker with at least low privileges (PR:L) to cause the Consul agent to consume excessive resources by growing the intention-match cache indefinitely. This can result in degraded availability or denial of service of the affected Consul agent. There is no impact on confidentiality or integrity according to the CVSS vector. The attack does not require user interaction and can be performed remotely over the network.

A fix is available in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3. Users should upgrade to these versions to remediate the vulnerability. No vendor advisory content contradicts this; therefore, upgrading to the fixed versions is the recommended mitigation.