High severity · published Jun 11, 2020
CVE-2020-13250
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service
7.5
CVSS
2.9%
EPSS
No
On KEV
Description
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Consul · Hashicorp
1.2.0 before 1.6.6; 1.2.0 before 1.6.6; 1.7.0 before 1.7.4; 1.7.0 before 1.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13250
Release Notes
https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md
Release Notes
https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
Patch
https://github.com/hashicorp/consul/pull/8023
More from Consul
8.8
CVE-2026-105608
Consul vulnerable to an authorization bypass in service mesh registration
8.8
CVE-2021-41805
HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control
8.8
CVE-2021-37219
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling…
8.6
CVE-2021-3121
An issue was discovered in GoGo Protobuf before 1.3.2
8.3
CVE-2026-87090
Consul vulnerable to an authorization bypass in the catalog node-write path