CVE-2026-19015 is a resource consumption vulnerability (CWE-770) affecting HashiCorp Consul Community Edition and Enterprise versions 1.2.0 through 2.0.2. The flaw exists in the Connect CA roots endpoint, where a remote unauthenticated attacker can cause the agent's Connect CA roots cache to grow without bound, ignoring the operator's cache-disable configuration. This uncontrolled resource allocation can lead to denial of service conditions due to resource exhaustion. The vulnerability is addressed in Consul 2.0.3 and Enterprise versions 1.21.17, 1.22.11, and 2.0.3.

An unauthenticated remote attacker can cause the Connect CA roots cache to grow indefinitely, potentially leading to resource exhaustion and denial of service on the affected Consul agent. There is no impact on confidentiality or integrity reported. The attack vector is network-based with no privileges or user interaction required.

A fix is available and users should upgrade to Consul version 2.0.3 or later, or to Enterprise versions 1.21.17, 1.22.11, or 2.0.3. Since this is a resource consumption issue, applying the official patches will prevent uncontrolled cache growth. No other mitigations are indicated by the vendor advisory.