HashiCorp Consul L7 deny intention results in an allow action

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-36213 · ADVISORY
• discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855 · WEB
• hashicorp/consul · WEB
• hashicorp/consul release v1.10.1 · WEB
• security.gentoo.org/glsa/202208-09 · WEB
• hashicorp.com/blog/category/consul · WEB
• GitHub Advisory GHSA-8h2g-r292-j8xh · ADVISORY

More vulnerabilities in github.com/hashicorp/consul

• CVE-2026-2808MEDIUM 6.8HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernete…
• CVE-2025-11375MEDIUM 6.5Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Conten…
• CVE-2025-11374MEDIUM 6.5Consul and Consul Enterprise’s (“Consul”) key/value endpoint is vulnerable to denial of service (DoS) due to incorrect Content Length header…
• CVE-2024-10086MEDIUM 6.1A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP head…
• CVE-2024-10006MEDIUM 5.8A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP…