# Consul changelog

> Service discovery and service mesh across any runtime.

- Vendor: HashiCorp
- Category: Infrastructure & DevOps
- Language: Go
- Official site: https://www.consul.io
- Tracked by: What's New (https://whatsnew.fyi/product/consul)
- Harvested from: GitHub (hashicorp/consul)
- Entries below: 14 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.1.0-rc2

- Date: 2026-10-13
- Version: v2.1.0-rc2
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.1.0-rc2
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.1.0-rc2
- Labels: Pre-release

- **security** — Upgrade go version to 1.26.9 to address security vulnerabilities
- **changed** — Upgrade github.com/hashicorp/raft-wal to v0.5.0 (with raft v1.8.0, serf v0.11.0, memberlist v0.7.0 and go-metrics v0.7.0), removing the dependency on github.com/coreos/etcd
- **security** — Upgrade golang.org/x/net to v0.60.0 to address GO-2026-6610, GO-2026-6611, GO-2026-6603, GO-2026-6617 and GO-2026-6612
- **changed** — Run apk upgrade when building the Alpine-based container images so base-image packages (such as sqlite and jq) are up to date
- **security** — Upgrade github.com/klauspost/compress to v1.18.7, go.mongodb.org/mongo-driver to v1.17.10, github.com/moby/go-archive to v0.3.0 and github.com/go-openapi/swag to v0.27.1 to address CVE-2026-63209, CVE-2026-88031, CVE-2026-2303, CVE-2026-17106 and CVE-2026-85280
- **security** — Add Content-Security-Policy header to Consul UI HTTP responses to mitigate XSS and data injection attacks
- **security** — Pin a newer resolution of morgan to 1.12.1 to address GHSA-9f6g-j8ch-79g4
- **changed** — Deliver the sidecar proxy's leaf certificate and CA roots to Envoy over SDS instead of embedding them inline in the public listener, making leaf certificate rotation a hitless hot-swap that no longer changes the listener filter chain hash so established connections are not drained on rotation
- **changed** — Deliver each linked service's Connect leaf certificate and the shared CA roots to Envoy over SDS instead of embedding them inline in the terminating gateway's downstream filter chains, so leaf rotation no longer drains established connections through the gateway
- **fixed** — Fix a goroutine and memory leak where a proxy's watches kept running after its state stopped unexpectedly, because replacing, deregistering or closing a stopped state did not cancel them
- **fixed** — Fix a goroutine and memory leak where transparent proxies registered a new health watch for every imported peered service each time the imported services list changed, and never stopped watches for removed upstreams
- **fixed** — Restore Raft, Serf, and Memberlist metrics in release artifacts by building with the hashicorpmetrics tag

##### 2.1.0-rc2 (October 12, 2026)
SECURITY:

* Upgrade go version to 1.26.9 to address security vulnerabilities. [[GH-24010](https://github.com/hashicorp/consul/issues/24010)]
* deps: Upgrade github.com/hashicorp/raft-wal to v0.5.0 (with raft v1.8.0, serf v0.11.0, memberlist v0.7.0 and go-metrics v0.7.0), removing the dependency on github.com/coreos/etcd. [[GH-23985](https://github.com/hashicorp/consul/issues/23985)]
* deps: Upgrade golang.org/x/net to v0.60.0 to address GO-2026-6610, GO-2026-6611, GO-2026-6603, GO-2026-6617 and GO-2026-6612. [[GH-23994](https://github.com/hashicorp/consul/issues/23994)]
* docker: Run `apk upgrade` when building the Alpine-based container images so base-image packages (such as sqlite and jq) are up to date. [[GH-23964](https://github.com/hashicorp/consul/issues/23964)]
* security: Upgrade github.com/klauspost/compress to v1.18.7, go.mongodb.org/mongo-driver to v1.17.10, github.com/moby/go-archive to v0.3.0 and github.com/go-openapi/swag to v0.27.1 to address CVE-2026-63209, CVE-2026-88031, CVE-2026-2303, CVE-2026-17106 and CVE-2026-85280. [[GH-23964](https://github.com/hashicorp/consul/issues/23964)]
* ui: Add Content-Security-Policy header to Consul UI HTTP responses to mitigate XSS and data injection attacks. [[GH-23971](https://github.com/hashicorp/consul/issues/23971)]
* ui: Pin a newer resolution of morgan to 1.12.1 to address GHSA-9f6g-j8ch-79g4 [[GH-23952](https://github.com/hashicorp/consul/issues/23952)]

IMPROVEMENTS:

* connect: deliver the sidecar proxy's leaf certificate and CA roots to Envoy over SDS instead of embedding them inline in the public listener. Leaf certificate rotation is now a hitless hot-swap that no longer changes the listener filter chain hash, so established connections (notably long-lived TCP sessions) are no longer drained and terminated on every rotation. [[GH-23938](https://github.com/hashicorp/consul/issues/23938)]
* terminating-gateway: deliver each linked service's Connect leaf certificate and the shared CA roots to Envoy over SDS instead of embedding them inline in the gateway's downstream filter chains. Leaf rotation no longer changes the filter chain hash, so established connections through the gateway are no longer drained. [[GH-23938](https://github.com/hashicorp/consul/issues/23938)]

BUG FIXES:

* proxycfg: Fixed a goroutine and memory leak where a proxy's watches kept running after its state stopped unexpectedly, because replacing, deregistering or closing a stopped state did not cancel them. [[GH-23990](https://github.com/hashicorp/consul/issues/23990)]
* proxycfg: Fixed a goroutine and memory leak where transparent proxies registered a new health watch for every imported peered service each time the imported services list changed, and never stopped watches for removed upstreams. [[GH-23990](https://github.com/hashicorp/consul/issues/23990)]
* telemetry: Restore Raft, Serf, and Memberlist metrics in release artifacts by building with the `hashicorpmetrics` tag. [[GH-23813](https://github.com/hashicorp/consul/issues/23813)]

### v2.1.0-rc1

- Date: 2026-09-29
- Version: v2.1.0-rc1
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.1.0-rc1
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.1.0-rc1
- Labels: Pre-release

- **changed** — Migrated the `consul connect redirect-traffic` command from `iptables`/`ip6tables` to `nftables` (`nft`), applying all IPv4 and IPv6 rules atomically in a single pass via the `nftables` `inet` address family
- **changed** — Transparent proxy exclusions are now validated before rules are applied: user IDs must be numeric and outbound exclusions must be IP addresses or CIDRs
- **changed** — The `consul connect redirect-traffic` command does not remove `iptables`/`ip6tables` rules created by earlier Consul versions
- **changed** — Official Consul container images now include `nftables` instead of `iptables`
- **changed** — Replaced the `iptables` package with a new `nftables` package in the SDK for transparent proxy traffic redirection
- **security** — Added debounce behavior to enforce a minimum interval between expensive federation-state anti-entropy sync operations
- **security** — Updated `brace-expansion` to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays)
- **security** — Updated `fast-uri` to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer)
- **security** — Updated `socket.io-parser` to address CVE-2026-69185 (Zero-attachment Memory Exhaustion)
- **added** — Add an inline `ai` block to service definitions for Enterprise, letting a workload declare its AI role (`inference-model`, `mcp-server`, or `ai-agent`) and role-specific configuration
- **added** — Add `http2` and `grpc` as valid API Gateway listener protocols, enabling end-to-end HTTP/2 and gRPC from client to backend
- **added** — Auto-register DNS for services exposed via an API Gateway, resolvable at `<service>.api-gateway.consul`
- **added** — Support zero-touch downstream TLS termination on API Gateway when `TLS { Enabled = true }` is set with no inline/file-system/SDS certificate
- **added** — Add `PassiveHealthCheck` to gateway-level default upstream limits and route service-level limit overrides for API Gateway
- **added** — For Enterprise, `consul connect envoy -gateway=inference` launches the policy processor alongside Envoy and enforces a minimum Envoy version for the inference gateway
- **added** — For Enterprise, added an agent-managed OAuth client lifecycle for services with `ai.role` of `ai-agent` or `mcp-server`
- **added** — For Enterprise, deliver OAuth sidecar credentials as AES-256-GCM envelopes with content-encryption keys persisted in KV

##### 2.1.0-rc1 (September 28, 2026)
BREAKING CHANGES:

* cli: Migrated the `consul connect redirect-traffic` command from `iptables`/`ip6tables` to `nftables` (`nft`). The command now uses the `sdk/nftables` package, which applies all IPv4 and IPv6 rules atomically in a single pass via the `nftables` `inet` address family, instead of separate `iptables` and `ip6tables` invocations. [[GH-23785](https://github.com/hashicorp/consul/issues/23785)]
* cli: Transparent proxy exclusions are now validated before rules are applied: user IDs must be numeric and outbound exclusions must be IP addresses or CIDRs. `iptables` previously also accepted user names, UID ranges, and host names. [[GH-23785](https://github.com/hashicorp/consul/issues/23785)]
* cli: `consul connect redirect-traffic` does not remove `iptables`/`ip6tables` rules created by earlier Consul versions. This only matters when upgrading an existing host or VM in place. Before running the new command on an existing host or VM, remove any Consul-managed `iptables` rules first (see the transparent proxy upgrade guide for a reference cleanup script). Leaving both rule sets in place can cause double NAT or inconsistent traffic redirection. [[GH-23785](https://github.com/hashicorp/consul/issues/23785)]
* docker: The official Consul container images now include `nftables` instead of `iptables`. Scripts that run `iptables` inside the Consul image must be updated. [[GH-23785](https://github.com/hashicorp/consul/issues/23785)]
* sdk: Replaced the `iptables` package with a new `nftables` package for transparent proxy traffic redirection. Traffic redirection now requires the `nft` binary and a Linux kernel with stateful NAT support in `nftables` `inet` family chains, available upstream starting with Linux kernel version 5.2 (some distributions backport this support onto an earlier nominal kernel version, for example RHEL 8+, kernel 4.18+, and its derivatives). There is no automatic fallback to `iptables`/`ip6tables`, so hosts without this kernel support will fail to set up transparent proxy redirection. [[GH-23785](https://github.com/hashicorp/consul/issues/23785)]

SECURITY:

* Added debounce behavior to enforce a minimum interval between expensive federation-state anti-entropy sync operations. [[GH-23196](https://github.com/hashicorp/consul/issues/23196)]
* Update `brace-expansion` to address [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895) (DoS via unbounded intermediate arrays). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]
* Update `fast-uri` to address [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7) (Host Confusion via backslash authority introducer). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]
* Update `socket.io-parser` to address [CVE-2026-69185](https://github.com/advisories/GHSA-2m8v-j782-fhvr) (Zero-attachment Memory Exhaustion). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]

FEATURES:

* agent: **(Enterprise only)** Add an inline `ai` block to service definitions, letting a workload declare its AI role (`inference-model`, `mcp-server`, or `ai-agent`) and role-specific configuration in a single registration via config files and HTTP APIs. [[GH-13032](https://github.com/hashicorp/consul/issues/13032)]
* api-gateway: Add `http2` and `grpc` as valid API Gateway listener protocols, enabling end-to-end HTTP/2 and gRPC from client to backend. Previously only `http` and `tcp` were accepted; the gateway would silently downgrade gRPC/HTTP2 traffic to HTTP/1.1 on the upstream hop. The new protocols render the correct downstream HTTP connection manager (HTTP/2 codec, `h2,http/1.1` ALPN) and align the upstream cluster to HTTP/2, closing the parity gap with Ingress Gateway. [[GH-23784](https://github.com/hashicorp/consul/issues/23784)]
* api-gateway: Auto-register DNS for services exposed via an API Gateway, resolvable at `<service>.api-gateway.consul`. Populates the `gateway-services`

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/consul/releases/tag/v2.1.0-rc1]_

### v2.0.4

- Date: 2026-09-10
- Version: v2.0.4
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.4
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.4

- **security** — Upgrade go version to 1.26.7 to address security vulnerabilities
- **security** — Require mesh:write in addition to service:write when attaching code-executing EnvoyExtensions (builtin/lua, builtin/wasm) or upstream escape-hatch overrides to a service-defaults config entry
- **security** — Require mesh:write in addition to service:write when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys
- **security** — Fixed a pre-authorization memory exhaustion vulnerability where an mTLS-authenticated RPC client with no ACL token could terminate a Consul server by sending a MessagePack request header with a large declared length
- **security** — Fixed an incorrect authorization vulnerability where a local ACL token with service:write or node:write could delete peer-imported catalog objects by supplying a non-default PeerName in a Catalog.Deregister request
- **security** — Upgrade golang.org/x/mod to v0.41.0, golang.org/x/crypto to v0.57.0, and golang.org/x/net to v0.59.0 to address security vulnerabilities
- **security** — Escape regex metacharacters in service name, namespace, partition, and trust domain values when building Envoy RBAC SPIFFE match patterns
- **changed** — Tokens that hold service:write but not mesh:write will now receive a permission-denied error when attempting to attach builtin/lua or builtin/wasm EnvoyExtensions to a service-defaults config entry
- **changed** — FIPS release artifacts are renamed from F2 suffix to F3 suffix and version metadata changes from +ent.fips1402 to +ent.fips1403
- **changed** — Migrate FIPS builds from FIPS 140-2 to FIPS 140-3 using the Go Cryptographic Module
- **fixed** — Fix a cold-start crash where an api-gateway's Envoy proxy could segfault during worker startup when a route's failover upstream was rendered as an aggregate cluster before its endpoints were assembled

##### 2.0.4 (September 10, 2026)
BREAKING CHANGES:

* acl: Tokens that hold service:write but not mesh:write will now receive a permission-denied error when attempting to attach builtin/lua or builtin/wasm EnvoyExtensions (or upstream envoy_listener_json/envoy_cluster_json escape-hatch overrides) to a service-defaults config entry, or when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config. Operators must grant mesh:write to any token that legitimately needs these capabilities. [[GH-23864](https://github.com/hashicorp/consul/issues/23864)]
* fips: **(Enterprise only)** FIPS release artifacts are renamed. Version metadata changes from `+ent.fips1402` to `+ent.fips1403`, and package and container artifacts change from the `F2` suffix to `F3` (for example, `consul-F2_1.20.4-1_amd64.deb` becomes `consul-F3_1.20.4-1_amd64.deb`). Pipelines that pin FIPS artifact names or version strings must be updated.

SECURITY:

* Upgrade go version to 1.26.7 to address security vulnerabilities. [[GH-23869](https://github.com/hashicorp/consul/issues/23869)]
* acl: Require mesh:write in addition to service:write when attaching code-executing EnvoyExtensions (builtin/lua, builtin/wasm) or upstream escape-hatch overrides (envoy_listener_json, envoy_cluster_json in UpstreamConfig defaults or overrides) to a service-defaults config entry. Previously a holder of service:write on a service could attach a Lua script or Wasm module, or an upstream escape-hatch override, that Envoy compiled and executed on every proxied request as the sidecar process user, with access to mTLS private keys, request bodies, and the host filesystem. [[GH-23864](https://github.com/hashicorp/consul/issues/23864)]
* acl: Require mesh:write in addition to service:write when registering a connect-proxy sidecar with bootstrap or xDS escape-hatch keys, whether set in the top-level Proxy.Config map or per-upstream in Proxy.Upstreams[*].Config (envoy_bootstrap_json_tpl, envoy_extra_static_listeners_json, envoy_public_listener_json, envoy_listener_json, envoy_cluster_json, envoy_local_cluster_json, envoy_extra_static_clusters_json, envoy_extra_stats_sinks_json, envoy_tracing_json, envoy_stats_config_json, envoy_listener_tracing_json). Key matching is case-insensitive to match the mapstructure decoding used downstream. Previously a holder of service:write on the proxy and its destination could inject arbitrary Envoy filter chain configuration into the sidecar bootstrap or xDS resources, including via a per-upstream override or a mixed-case key. [[GH-23864](https://github.com/hashicorp/consul/issues/23864)]
* agent: Fixed a pre-authorization memory exhaustion vulnerability where
an mTLS-authenticated RPC client with no ACL token could terminate a Consul server by
sending a MessagePack request header with a large declared length. The MessagePack
decoder allocated a byte slice of the declared size before method lookup, ACL token
validation, or the rate-limiting interceptor could run, allowing a single oversized
header to OOM-kill the server process.

Two mitigations are applied:

1. Each RPC request header is now validated against RPCMaxHeaderBytes (default 512
   bytes) before it is decoded. Every length prefix in the header is checked against
   the limit, so an oversized value is rejected before the decoder allocates memory
   for it, and the connection is closed before any ACL evaluation. Request bodies
   remain unbounded by this limit.

2. A per-request read deadline (reusing RPCHandshakeTimeout) is applied inside
   handleConsulConn and handleInsecureConn so that a slow attacker trickling an
   oversized header cannot retain a goroutine and logical heap indefinitely.
* catalog: Fixed an incorrect authorization vulnerability where a local
ACL token with `service:write` or `node:write` could delete peer-imported catalog
objects by supplying a non-d

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/consul/releases/tag/v2.0.4]_

### v2.0.3

- Date: 2026-08-07
- Version: v2.0.3
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.3
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.3

- **security** — Update brace-expansion to address DoS via unbounded intermediate arrays
- **security** — Update fast-uri to address Host Confusion via backslash authority introducer
- **security** — Update golang.org/x/text to v0.39.0 to address GO-2026-5970
- **security** — Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf
- **security** — Update socket.io-parser to address Zero-attachment Memory Exhaustion
- **security** — Upgrade to use Go 1.26.5 to resolve vulnerabilities GO-2026-4970 (os) and GO-2026-5856 (crypto/tls)
- **security** — Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots and POST /v1/agent/connect/authorize used the agent-side cache unconditionally even when http_config { use_cache = false } was configured
- **security** — Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt when a service-router config entry contained a route with a nil Destination
- **security** — Fixed a security bypass where a user-supplied public listener with an HTTP Connection Manager filter would skip Consul's inbound request-normalization defaults, allowing attackers to bypass L7 intention deny rules using percent-encoded path equivalents
- **security** — Fixed an unauthenticated denial-of-service vulnerability where PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register, PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize decoded unbounded JSON request bodies before resolving the caller's ACL token, now capped at 512 KiB
- **security** — Fixed an unauthenticated denial-of-service vulnerability where the external gRPC and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP, now controlled by limits.grpc_max_conns_per_client configuration option (default 100)
- **added** — Add two new opt-in ProxyDefaults.spec.config keys for controlling the server response header on API Gateway HTTP listeners: envoy_suppress_envoy_headers and envoy_server_header_name
- **fixed** — Stop logging the raw ACL token in debug-level content-type logs
- **fixed** — Fixed a regression that caused an HTTP API gateway to reject its configuration with an inconsistent protocols error when a backend service's service-router composed a route to a destination in a different service, namespace, or partition
- **fixed** — Fix WAN flood-join to ignore non-alive destination members (leaving/left/failed), allowing rejoined servers to heal back to alive in WAN membership
- **fixed** — Addition of XFCC headers to gRPC request similar to HTTP request for connect-proxy inbound listener

##### 2.0.3 (August 7, 2026)
SECURITY:

* Update `brace-expansion` to address [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895) (DoS via unbounded intermediate arrays). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]
* Update `fast-uri` to address [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7) (Host Confusion via backslash authority introducer). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]
* Update `golang.org/x/text` to v0.39.0 to address [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970). [[GH-23761](https://github.com/hashicorp/consul/issues/23761)]
* Update `google.golang.org/grpc` to v1.82.1 to address [GHSA-hrxh-6v49-42gf](https://github.com/advisories/GHSA-hrxh-6v49-42gf). [[GH-23761](https://github.com/hashicorp/consul/issues/23761)]
* Update `socket.io-parser` to address [CVE-2026-69185](https://github.com/advisories/GHSA-2m8v-j782-fhvr) (Zero-attachment Memory Exhaustion). [[GH-23786](https://github.com/hashicorp/consul/issues/23786)]
* Upgrade to use Go `1.26.5`. This resolves vulnerabilities
[GO-2026-4970](https://pkg.go.dev/vuln/GO-2026-4970) (`os`).
[GO-2026-5856](https://pkg.go.dev/vuln/GO-2026-5856) (`crypto/tls`). [[GH-23761](https://github.com/hashicorp/consul/issues/23761)]
* agent: Fixed a denial-of-service vulnerability where `GET /v1/agent/connect/ca/roots`
and `POST /v1/agent/connect/authorize` used the agent-side cache unconditionally, even
when `http_config { use_cache = false }` was configured by the operator. A remote caller
could bypass this setting and grow the agent cache without bound by varying the request
ACL token. Both endpoints now skip the cache and issue a direct RPC when `use_cache` is
disabled. (SECVULN-50292, SECVULN-50293) [[GH-23797](https://github.com/hashicorp/consul/issues/23797)]
* agent: Fixed a nil-pointer dereference panic in `ShadowServiceRouterConfigEntry.CheckEnt`
when a service-router config entry contained a route with a nil `Destination`. A crafted
snapshot restore or replication message containing such an entry could crash the FSM
decode path. The nil guard now treats a missing destination as non-enterprise data and
continues decoding safely. (SECVULN-50291) [[GH-23797](https://github.com/hashicorp/consul/issues/23797)]
* agent: Fixed a security bypass where a user-supplied public listener
(`envoy_public_listener_json`) with an HTTP Connection Manager filter would skip Consul's
inbound request-normalization defaults. An attacker could exploit the un-normalized path
to bypass L7 intention `deny` rules using percent-encoded path equivalents. Consul now
injects path normalization (enabled by default, unless the mesh config option
`InsecureDisablePathNormalization` is set) on every HCM filter chain in user-provided
public listeners before L7 intention enforcement is applied. (SECVULN-50295) [[GH-23797](https://github.com/hashicorp/consul/issues/23797)]
* agent: Fixed an unauthenticated denial-of-service vulnerability where
`PUT /v1/agent/check/update/:id`, `PUT /v1/agent/check/register`,
`PUT /v1/agent/service/register`, and `POST /v1/agent/connect/authorize`
decoded unbounded JSON request bodies before resolving the caller's ACL
token. An unauthenticated caller could retain multiple large JSON decoder
buffers concurrently inside the Consul process before each request was
rejected with HTTP 403, causing attacker-controlled heap growth. All four
endpoints now cap the request body at 512 KiB before any decoding occurs,
returning HTTP 413 for oversized bodies. This limit applies to chunked
transfer encoding as well as declared `Content-Length`.
(SECVULN-50418) [[GH-23796](https://github.com/hashicorp/consul/issues/23796)]
* agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC
and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP
before any request processing, ACL check, or rate limiting could occur. A remote attacker
could exhaust

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/consul/releases/tag/v2.0.3]_

### v2.0.2

- Date: 2026-07-08
- Version: v2.0.2
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.2
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.2

- **security** — Upgrade alpine base image version to 3.24 to address CVE-2026-41989 and ALPINE-CVE-2026-2100
- **security** — Upgrade Serf and Memberlist to use the latest versions
- **security** — Return errors when injecting the L4 intention (RBAC) filter or the mTLS transport socket onto an inbound public listener, so the listener is not served without intention enforcement or mTLS
- **added** — Add ExtAuthzFilter to HTTPRoute Filters and gateway-wide ExtAuthz toggle to the api-gateway config entry (Enterprise only)
- **added** — Add External Processor (ext_proc) Envoy Extension support to api-gateway and connect-proxy (Enterprise only)
- **changed** — Update support for nomad and vault version to v2.0.3
- **changed** — Migrate armon/go-metrics to hashicorp/go-metrics and update Go dependencies across all modules
- **fixed** — Only emit the client cert SDS block when both CertFile and KeyFile are set

##### 2.0.2 (July 8, 2026)
SECURITY:

* Upgrade alpine base image version to 3.24 to address [CVE-2026-41989], [ALPINE-CVE-2026-2100]. [[GH-23711](https://github.com/hashicorp/consul/issues/23711)]
* dependency: Upgrade Serf and Memberlist to use the latest versions. [[GH-23704](https://github.com/hashicorp/consul/issues/23704)]
* xds: Return errors when injecting the L4 intention (RBAC) filter or the mTLS transport socket onto an inbound public listener, so the listener is not served without intention enforcement or mTLS. [[GH-23686](https://github.com/hashicorp/consul/issues/23686)]

FEATURES:

* config-entry(api-gateway): (Enterprise only) Add ExtAuthzFilter to HTTPRoute Filters and gateway-wide ExtAuthz toggle to the api-gateway config entry [[GH-23703](https://github.com/hashicorp/consul/issues/23703)]
* config-entry: (Enterprise only) Addition of External Processor (ext_proc) Envoy Extension support to api-gateway and connect-proxy [[GH-23705](https://github.com/hashicorp/consul/issues/23705)]

IMPROVEMENTS:

* ci: upgrade GitHub Actions that used the deprecated Node 20 runtime to Node 24, and restore GOTOOLCHAIN=auto after setup-go so backward-compatibility and integration test lanes resolve the correct Go toolchain. [[GH-23687](https://github.com/hashicorp/consul/issues/23687)]
* connect: update support for nomad and vault version to v2.0.3 [[GH-23624](https://github.com/hashicorp/consul/issues/23624)]
* deps: Migrate `armon/go-metrics` to `hashicorp/go-metrics` and update Go dependencies across all modules [[GH-23635](https://github.com/hashicorp/consul/issues/23635)]

BUG FIXES:

* xds: only emit the client cert SDS block when both CertFile and KeyFile are set. [[GH-23679](https://github.com/hashicorp/consul/issues/23679)]

KNOWN ISSUES:

* consul-k8s: In setups using consul OSS version, consul-k8s-connect-injector fails to come up because of a missing CRD RouteExtProc. A new version(2.0.2-oss) of consul helm chart is released to resolve this issue. Use the Chart version '2.0.2-oss' for OSS distribution of consul of this release v2.0.2.
* consul (enterprise only): Since (2.0.0) API-GW understands traffic routing via discovery chain configs(resolvers, routers, splitters) attached to services in its route-match destinations. API gateways understands listeners on a hostname basis and compiles overall traffic routing rules for services pointed in the routes for those listeners. A bug surfaced when the destination service has defined failovers/redirects/subsets with targets in different namespace/partition in its resolvers config. The reconciliation of overall discovery chain for all routable targets of api gateway post this feature encounters issues due to missing synthetic defaults for protocols in the said use case and causes xds rendering issues.

### v2.0.1

- Date: 2026-06-19
- Version: v2.0.1
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.1
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.1

- **security** — Upgrade Go version to 1.26.4 to address GO-2026-5039, GO-2026-5038, GO-2026-5037
- **security** — Upgrade Envoy version to 1.37.4, 1.36.8, 1.35.12 and add new version 1.38.2, remove 1.34.14
- **changed** — Reduce Dockerfile layers by merging RUN commands and following best practices
- **changed** — Product usage reporting now preserves export cadence across restarts and leader re-elections by resuming from the last successful export time
- **changed** — Auth method TokenNameFormat field accepts OIDC and JWT claim mapping values
- **changed** — Remove block-slot addon dependency from UI
- **fixed** — Strip the x-forwarded-client-cert header from inbound HTTP requests before forwarding them to local service instances
- **fixed** — Fix a bug where renaming a server or wiping and rejoining it with the same IP and Raft node ID could cause an out-of-order serf event to evict the live leader from the internal server lookup, resulting in Raft leader not found errors

##### 2.0.1 (June 18, 2026)

SECURITY:

* Upgrade go version to 1.26.4 to address [GO-2026-5039](https://pkg.go.dev/vuln/GO-2026-5039), [GO-2026-5038](https://pkg.go.dev/vuln/GO-2026-5038),[GO-2026-5037](https://pkg.go.dev/vuln/GO-2026-5037) [[GH-23637](https://github.com/hashicorp/consul/issues/23637)]
* connect: Upgrade envoy version to 1.37.4, 1.36.8, 1.35.12; Add new version of Envoy 1.38.2 and remove 1.34.14 [[GH-23664](https://github.com/hashicorp/consul/issues/23664)]

IMPROVEMENTS:

* dockerfile: layer reduction by merging RUN commands and minor changes following best practices. [[GH-23650](https://github.com/hashicorp/consul/issues/23650)]
* product-telemetry: product usage reporting now preserves export cadence across restarts and leader re-elections by resuming from the last successful export time, preventing delays
* server: Auth method TokenNameFormat field accepts OIDC and JWT claim mapping values [[GH-23616](https://github.com/hashicorp/consul/issues/23616)]
* ui: Removed block-slot addon dependency [[GH-23481](https://github.com/hashicorp/consul/issues/23481)]

BUG FIXES:

* connect: Strip the `x-forwarded-client-cert` header from inbound HTTP requests before forwarding them to local service instances. [[GH-23544](https://github.com/hashicorp/consul/issues/23544)]
* server: Fixed a bug where renaming a server (or wiping and rejoining it with the same IP and Raft node ID) could cause an out-of-order serf event to evict the live leader from the internal server lookup, resulting in `Raft leader not found in server lookup mapping` (HTTP 500) errors on follower RPCs until the next member event resynced the mapping. [[GH-23533](https://github.com/hashicorp/consul/issues/23533)]

### v2.0.0

- Date: 2026-05-24
- Version: v2.0.0
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.0
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.0

- **security** — Upgrade envoy version to 1.37.2 and newer versions
- **security** — Upgrade go version to 1.26
- **security** — Increase default HTTP server timeouts to prevent breaking long-polling blocking queries, with read_timeout and write_timeout now set to 15 minutes (up from 30 seconds)
- **security** — Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005)
- **security** — Update ubi base image to ubi9-minimal:9.7
- **security** — Upgrade curl to >= 8.20.0 in the container image to address CVE-2026-6429, CVE-2026-4873, CVE-2026-5773, CVE-2026-6253, CVE-2026-6276, CVE-2026-7168, and CVE-2026-5545
- **security** — Update UBI base image to 9.8 for fixing CVE-2026-2100
- **added** — Add new rate-limit config entry kind for dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers
- **added** — Add SDS certificate support for API Gateway listeners, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides
- **added** — Add gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests
- **added** — Add new API /v1/internal/rpc/methods that lists all RPC method names
- **added** — Add new Connect CA provider for Cyberark WIM (connect.ca_provider = "pan-distributed-issuer")
- **added** — Add stable cluster identity and leader-gated global registry sync for service summary publishing
- **added** — Add product telemetry for self-managed Consul with anonymous, opt-in usage reporting
- **added** — Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names and to retrieve virtual IPs for specific service ports
- **changed** — Update cluster upstream tls in terminating-gateway to use sds instead of static certs, allowing for dynamic certificate updates without needing to restart the terminating gateway
- **changed** — Add certificate expiry monitoring with Prometheus metrics and structured logging with configurable severity thresholds
- **changed** — Upgrade github.com/hashicorp/vault/sdk from v0.7.0 to v0.25.1 and github.com/hashicorp/vault/api from v1.12.2 to v1.16.0
- **changed** — Add eventually-consistent background cache for Enterprise usage metrics, reducing GET /v1/operator/usage latency from O(P*N*K) to O(1)

##### 2.0.0 (May 22, 2026)

SECURITY:

* connect: Upgrade envoy version to 1.37.2 and newer versions [[GH-23469](https://github.com/hashicorp/consul/pull/23469)]
* go: Upgrade go version to 1.26 [[GH-23493](https://github.com/hashicorp/consul/pull/23493)]
* agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. `read_timeout` and `write_timeout` are now set to 15 minutes (up from 30 seconds), while `read_header_timeout` (10s) and `idle_timeout` (120s) still provide protection against Slowloris attacks. All timeouts remain configurable via the `http_config` block. [[GH-23267](https://github.com/hashicorp/consul/issues/23267)]
* api-gateway, terminating-gateway: Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005). [[GH-23534](https://github.com/hashicorp/consul/issues/23534)]
* docker: update ubi base image to `ubi9-minimal:9.7`. [[GH-23553](https://github.com/hashicorp/consul/issues/23553)]
* docker: Upgrade `curl` to >= 8.20.0 from Alpine edge in the container image to address
[CVE-2026-6429](https://www.cve.org/CVERecord?id=CVE-2026-6429),
[CVE-2026-4873](https://www.cve.org/CVERecord?id=CVE-2026-4873),
[CVE-2026-5773](https://www.cve.org/CVERecord?id=CVE-2026-5773),
[CVE-2026-6253](https://www.cve.org/CVERecord?id=CVE-2026-6253),
[CVE-2026-6276](https://www.cve.org/CVERecord?id=CVE-2026-6276),
[CVE-2026-7168](https://www.cve.org/CVERecord?id=CVE-2026-7168),
[CVE-2026-5545](https://www.cve.org/CVERecord?id=CVE-2026-5545).
Alpine 3.23 stable does not yet carry the patched version. [[GH-23750](https://github.com/hashicorp/consul/issues/23750)]
* docker: Update to UBI base image to 9.8 for fixing [[CVE_2026-2100](https://access.redhat.com/security/cve/cve-2026-2100)] [[GH-23588](https://github.com/hashicorp/consul/issues/23588)]

FEATURES:

* **(Enterprise Only)** update to go-licensing/v4 and go-census/v3 inorder to adapt to new licenses of PAO.
* Global Rate Limiter: **(Enterprise Only)** a new "rate-limit" config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers. This allows operators to apply or adjust global rate limits at runtime without restarting Consul servers — a critical capability for emergency scenarios where the cluster is under excessive load.
* api-gateway: Added SDS certificate support for API Gateway listeners, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides. Service overrides inherit the listener SDS cluster when omitted, and gateway validation/xDS generation now rejects conflicting override mappings to keep certificate selection deterministic. [[GH-23354](https://github.com/hashicorp/consul/pull/23354)]
* api-gateway: add support for gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests. [[GH-23396](https://github.com/hashicorp/consul/pull/23396)]
* api: Added new API "/v1/internal/rpc/methods" that lists all RPC method names. Requires an operator:read ACL token. This is useful when users want to configure rate limits that exclude specific RPC endpoints. [[GH-23329](https://github.com/hashicorp/consul/pull/23329)]
* ca: **(Enterprise Only)** Added new Connect CA provider for Cyberark WIM (connect.ca_provider = "pan-distributed-issuer"), enabling Consul to issue certificates through Cyberark WIM.
* server: **(Enterprise Only)** add stable cluster identity and leader-gated global registry sync for service summary publishing.
* telemetry: **(Enterprise Only)** Product telemetry for self-managed Consul with anonymous, opt-in usage reporting.
* mesh: **(Enterprise Only)** Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names, as well as to ret

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/consul/releases/tag/v2.0.0]_

### v2.0.0-rc2

- Date: 2026-05-15
- Version: v2.0.0-rc2
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.0-rc2
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.0-rc2
- Labels: Pre-release

- **security** — Increased default HTTP server timeouts to prevent breaking long-polling blocking queries, with read_timeout and write_timeout now set to 15 minutes (up from 30 seconds), while read_header_timeout (10s) and idle_timeout (120s) still provide protection against Slowloris attacks
- **security** — Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005)
- **security** — Update ubi base image to ubi9-minimal:9.7
- **security** — Fixed Consul transaction endpoint authorization bypasses where service and check mutations could be authorized using request-provided names while applying changes by ID, including a bypass using the reserved consul service name
- **fixed** — Fixed issue with mesh-gateway in remote mode on AWS EKS where DNS hostnames are assigned to AWS NLBs instead of IPs by skipping EDS load assignment for non-peer remote mesh gateway targets with hostname based gateways to keep CDS/EDS in sync
- **fixed** — Resolve service subsets for routes during API gateway discovery chain synthesis

##### 2.0.0-rc2 (May 15, 2026)

SECURITY:

* agent: Increased default HTTP server timeouts to prevent breaking long-polling blocking queries. `read_timeout` and `write_timeout` are now set to 15 minutes (up from 30 seconds), while `read_header_timeout` (10s) and `idle_timeout` (120s) still provide protection against Slowloris attacks. All timeouts remain configurable via the `http_config` block. [[GH-23267](https://github.com/hashicorp/consul/issues/23267)]
* api-gateway, terminating-gateway: Apply HTTP request path normalization on api-gateway and terminating-gateway HTTP listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005). [[GH-23534](https://github.com/hashicorp/consul/issues/23534)]
* docker: update ubi base image to `ubi9-minimal:9.7`. [[GH-23553](https://github.com/hashicorp/consul/issues/23553)]
* security: Fixed Consul transaction endpoint authorization bypasses where service and check mutations could be authorized using request-provided names while applying changes by ID, including a bypass using the reserved `consul` service name. [[GH-12716](https://github.com/hashicorp/consul/issues/12716)]

BUG FIXES:

* XDS: Fixes issue with mesh-gateway in remote mode on AWS EKS, as DNS hostnames are assigned to AWS NLBs instead of IPs and envoy's EDS endpoint validation expects address to be an IP. Now EDS load assignment is skipped for non-peer remote mesh gateway targets with hostname based gateways keeping CDS/EDS in sync. [[GH-23543](https://github.com/hashicorp/consul/issues/23543)]
* api-gateway: resolve service subsets for routes during API gateway discovery chain synthesis. [[GH-23294](https://github.com/hashicorp/consul/issues/23294)]

### v2.0.0-rc1

- Date: 2026-04-29
- Version: v2.0.0-rc1
- Original notes: https://github.com/hashicorp/consul/releases/tag/v2.0.0-rc1
- Permalink: https://whatsnew.fyi/product/consul/releases/v2.0.0-rc1
- Labels: Pre-release

- **security** — Upgrade envoy version to 1.37.2 and newer versions
- **security** — Upgrade go version to 1.26
- **added** — Global Rate Limiter: a new rate-limit config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers
- **added** — API Gateway listeners now support SDS certificate support, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides
- **added** — API Gateway now supports gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests
- **added** — Added new API /v1/internal/rpc/methods that lists all RPC method names
- **added** — Added new Connect CA provider for Cyberark WIM (connect.ca_provider = pan-distributed-issuer), enabling Consul to issue certificates through Cyberark WIM
- **added** — Introduced support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names and to retrieve virtual IPs for specific service ports
- **added** — Product telemetry for self-managed Consul with anonymous, opt-in usage reporting
- **changed** — Terminating gateway cluster upstream TLS now uses SDS instead of static certs, allowing for dynamic certificate updates without needing to restart the terminating gateway
- **added** — Added certificate expiry monitoring with Prometheus metrics labeled with datacenter/partition/namespace
- **added** — Enhanced Connect CA API to include NotAfter field for root and intermediate certificates
- **fixed** — Fixed JSON unmarshall error when array of obj is passed for auditReq body
- **fixed** — Enhanced error messages in consul config write command to provide actionable guidance when config entries cannot be modified due to references by gateways or routers
- **fixed** — Fixed XDS package to generate correct endpoints and cluster configurations for API Gateways when peered

##### 2.0.0-rc1 (April 29, 2026)

SECURITY:

* connect: Upgrade envoy version to 1.37.2 and newer versions [[GH-23469](https://github.com/hashicorp/consul/pull/23469)]
* go: Upgrade go version to 1.26 [[GH-23493](https://github.com/hashicorp/consul/pull/23493)]

FEATURES:

* **(Enterprise Only)** update to go-licensing/v4 and go-census/v3 inorder to adapt to new licenses of PAO.
* Global Rate Limiter: **(Enterprise Only)** a new "rate-limit" config entry kind that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers. This allows operators to apply or adjust global rate limits at runtime without restarting Consul servers — a critical capability for emergency scenarios where the cluster is under excessive load.
* api-gateway: Added SDS certificate support for API Gateway listeners, including listener-level default TLS certificates and HTTP/TCP route service TLS SDS overrides. Service overrides inherit the listener SDS cluster when omitted, and gateway validation/xDS generation now rejects conflicting override mappings to keep certificate selection deterministic. [[GH-23354](https://github.com/hashicorp/consul/pull/23354)]
* api-gateway: add support for gateway-level default upstream limits and route service-level limit overrides for MaxConnections, MaxPendingRequests, and MaxConcurrentRequests. [[GH-23396](https://github.com/hashicorp/consul/pull/23396)]
* api: Added new API "/v1/internal/rpc/methods" that lists all RPC method names. Requires an operator:read ACL token. This is useful when users want to configure rate limits that exclude specific RPC endpoints. [[GH-23329](https://github.com/hashicorp/consul/pull/23329)]
* ca: **(Enterprise Only)** Added new Connect CA provider for Cyberark WIM (connect.ca_provider = "pan-distributed-issuer"), enabling Consul to issue certificates through Cyberark WIM.
* server: **(Enterprise Only)** add stable cluster identity and leader-gated global registry sync for service summary publishing.
* telemetry: **(Enterprise Only)** Product telemetry for self-managed Consul with anonymous, opt-in usage reporting.
* mesh: **(Enterprise Only)** Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names, as well as to retrieve virtual IPs for specific service ports. It also enforces that certain advanced multi-port features are only available in Consul Enterprise, and includes new utility functions for cluster naming and ALPN protocol generation. 

IMPROVEMENTS:

* agent: **(Enterprise Only)** Add eventually-consistent background cache for Enterprise usage metrics, reducing GET /v1/operator/usage latency from O(P*N*K) to O(1) and lowering CPU/memory pressure during high-frequency scraping via a watch-driven maintainer goroutine.
* mesh: **(Enterprise Only)** Introduce support for multi-port (named port) services in Consul, including the ability to specify and route traffic using port names, as well as to retrieve virtual IPs for specific service ports. It also enforces that certain advanced multi-port features are only available in Consul Enterprise, and includes new utility functions for cluster naming and ALPN protocol generation.
* terminating-gateway: Updated the cluster upstream tls to use sds instead of static certs, allowing for dynamic certificate updates without needing to restart the terminating gateway. [[GH-23288](https://github.com/hashicorp/consul/pull/23288)]
* telemetry: Add certificate expiry monitoring with Prometheus metrics (labeled with datacenter/partition/namespace), structured logging with configurable severity thresholds, and enhanced Connect CA API to include NotAfter field for root and intermediate certificates. [[GH-23147](https://github.com/hashicorp/consul/pull/23147)]

BUG FIXES:

* audit-logging: **(Enterprise Only)** Fixed JSON unmarshall error when array of obj is passed for auditReq body. 
* cli: Enhanced error messages in `consul config w

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/consul/releases/tag/v2.0.0-rc1]_

### v1.22.7

- Date: 2026-04-25
- Version: v1.22.7
- Original notes: https://github.com/hashicorp/consul/releases/tag/v1.22.7
- Permalink: https://whatsnew.fyi/product/consul/releases/v1.22.7

- **security** — Update google.golang.org/grpc to fix CVE-2026-33186
- **security** — Upgrade go.opentelemetry.io/otel to 1.42.0 to remediate CVE-2026-24051 (Path Hijacking / Untrusted Search Paths on macOS)
- **security** — Update Rollup to 2.80.0 in UI to address CVE-2026-27606
- **added** — Add TokenNameFormat field to auth-method and parse the same for token name
- **changed** — Remove the use of hashstructure_v2 from compiled discovery chain hashing and replace it with explicit custom hash implementations
- **changed** — Remove consul docs website related code from UI as it is being maintained in a separate internal repository
- **fixed** — Fix HTTPRoute PathPrefix routing to preserve the original request path when replacePrefixMatch is not configured

##### 1.22.7 (April 21, 2026)

SECURITY:

* security: update google.golang.org/grpc to fix CVE-2026-33186 [[GH-23379](https://github.com/hashicorp/consul/issues/23379)]
* security: upgrade go.opentelemetry.io/otel to 1.42.0 to remediate CVE-2026-24051 (Path Hijacking / Untrusted Search Paths on macOS). [[GH-23387](https://github.com/hashicorp/consul/issues/23387)]
* test-sds-server: bump github.com/hashicorp/consul to v1.22.5 in integration test module to align with the CVE-2026-2808 fixed release line. [[GH-23437](https://github.com/hashicorp/consul/issues/23437)]
* ui: **(Enterprise only)** Backport Rollup update to 2.80.0 for release/1.21.x to address CVE-2026-27606 (SECVULN-38912). 

IMPROVEMENTS:

* acl: Addition of TokenNameFormat field to auth-method and parse the same for token name [[GH-23444](https://github.com/hashicorp/consul/issues/23444)]
* discovery-chain: removes the use of hashstructure_v2 ([github.com/mitchellh/hashstructure/v2] from compiled discovery chain hashing and replaces it with explicit custom hash implementations. [[GH-23393](https://github.com/hashicorp/consul/issues/23393)]
* ui: removed consul docs website related code as it is being maintained in a separate internal repository. [[GH-23398](https://github.com/hashicorp/consul/issues/23398)]

BUG FIXES:

* api-gateway: fix HTTPRoute PathPrefix routing to preserve the original request path when `replacePrefixMatch` is not configured [[GH-23390](https://github.com/hashicorp/consul/issues/23390)]

### v1.22.6

- Date: 2026-03-26
- Version: v1.22.6
- Original notes: https://github.com/hashicorp/consul/releases/tag/v1.22.6
- Permalink: https://whatsnew.fyi/product/consul/releases/v1.22.6

- **security** — Upgrade Envoy version to 1.35.9 and 1.34.13
- **security** — Update google.golang.org/grpc to fix CVE-2026-33186
- **security** — Upgrade Go version to 1.25.8
- **security** — Bump golang.org/x/* dependencies to align with consul-enterprise and address security vulnerabilities
- **added** — Add support to disable traffic with weight 0 in services for HTTPRoute backends, allowing explicit zero-weight backends to be excluded from traffic
- **fixed** — Fix Consul UI to work in non-secure environments by enabling Ember Data's UUID polyfill for crypto.randomUUID
- **fixed** — Fix Consul UI services page navigation by ensuring route transitions trigger the expected model hook behavior after Ember upgrade
- **changed** — Replace deprecated SideNav component with AppSideNav for improved navigation structure

##### 1.22.6 (March 23, 2026)

SECURITY:

* security: upgrade envoy version to 1.35.9 and 1.34.13 [[GH-23372](https://github.com/hashicorp/consul/pull/23372)]
* security: update google.golang.org/grpc to fix CVE-2026-33186 [[GH-23379](https://github.com/hashicorp/consul/pull/23379)]
* security: upgrade go version to 1.25.8 [[GH-23322](https://github.com/hashicorp/consul/pull/23322)]
* security: bump golang.org/x/* dependencies to align with consul-enterprise and address security vulnerabilities. [[GH-23322](https://github.com/hashicorp/consul/pull/23322)]

IMPROVEMENTS:

* api-gateway: Add support to disable traffic with weight 0 in services for HTTPRoute backends, allowing explicit zero-weight backends to be excluded from traffic. [[GH-23216](https://github.com/hashicorp/consul/pull/23216)]
* ui: Fixed Consul UI to work in non-secure environments by enabling Ember Data's UUID polyfill for crypto.randomUUID. [[GH-23341](https://github.com/hashicorp/consul/pull/23341)]
* ui: Fixed Consul UI services page navigation by ensuring route transitions trigger the expected model hook behavior after Ember upgrade. [[GH-23271](https://github.com/hashicorp/consul/pull/23271)]
* ui: Replaced deprecated SideNav component with AppSideNav for improved navigation structure. [[GH-23289](https://github.com/hashicorp/consul/pull/23289)]

### v1.22.5

- Date: 2026-02-27
- Version: v1.22.5
- Original notes: https://github.com/hashicorp/consul/releases/tag/v1.22.5
- Permalink: https://whatsnew.fyi/product/consul/releases/v1.22.5

- **security** — Upgrade Go version to 1.25.7
- **security** — Update Consul build Go base image to alpine3.23
- **security** — Migrate to aws-sdk-go-v2 from aws-sdk-go (v1) and updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions
- **security** — Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints
- **security** — Patch Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods
- **security** — Introduce debounce timing for synchronization operations within federationStateAntiEntropySync
- **fixed** — Fix duplicate matcher errors in Envoy when using multiple file-system certificates on a single TLS listener by consolidating certificates into a single filter chain
- **fixed** — Fix vault provider failure when signing intermediate CA with isCA=true in CSR
- **added** — Add --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration
- **fixed** — Cancel context check for watches cache fetch to stop execution when manager deregisters the watch

##### 1.22.5 (February 26, 2026)

SECURITY:
* security: upgrade go version to 1.25.7 [[GH-23204](https://github.com/hashicorp/consul/issues/23204)]
* dockerfile: the Consul build Go base image to `alpine3.23` [[GH-23194](https://github.com/hashicorp/consul/issues/23194)]
* connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [[GH-23109](https://github.com/hashicorp/consul/issues/23109)]
* security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [[GH-22739](https://github.com/hashicorp/consul/issues/22739)]
* security: Patched Vault CA provider to prevent arbitrary file reads via Kubernetes, JWT, and AppRole methods. [[GH-23249](https://github.com/hashicorp/consul/pull/23249)]
* security: Introduced debounce timing for synchronization operations within federationStateAntiEntropySync. [[GH-23196](https://github.com/hashicorp/consul/pull/23196)]

IMPROVEMENTS:
* api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [[GH-23212](https://github.com/hashicorp/consul/issues/23212)]
* agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [[GH-23202](https://github.com/hashicorp/consul/issues/23202)]
* cli: Added `--aws-iam-endpoint` flag to `consul login` command for AWS IAM auth method to support custom IAM endpoint configuration [[GH-23109](https://github.com/hashicorp/consul/issues/23109)]
* docs: Refreshed the security documentation to include the new HTTP server timeout defaults and relevant configuration options. [[GH-23246](https://github.com/hashicorp/consul/pull/23246)]
* api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [[GH-23157](https://github.com/hashicorp/consul/issues/23157)]

### v1.22.4

- Date: 2026-02-19
- Version: v1.22.4
- Original notes: https://github.com/hashicorp/consul/releases/tag/v1.22.4
- Permalink: https://whatsnew.fyi/product/consul/releases/v1.22.4

- **security** — Upgrade Go version to 1.25.7
- **security** — Update Consul build Go base image to alpine3.23
- **security** — Migrate to aws-sdk-go-v2 from aws-sdk-go (v1) and update consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions
- **security** — Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints
- **fixed** — Fix duplicate matcher errors in Envoy when using multiple file-system certificates on a single TLS listener by consolidating certificates into a single filter chain
- **fixed** — Fix vault provider failure when signing intermediate CA with isCA=true in CSR
- **added** — Add --aws-iam-endpoint flag to consul login command for AWS IAM auth method to support custom IAM endpoint configuration
- **fixed** — Cancel context check for watches cache fetch to stop execution when manager deregisters the watch

⚠️ Important Notice

**We have identified an issue in Consul and Consul Enterprise Feb Patch Release (1.22.4, 1.22.4-ent, 1.21.10-ent, 1.18.20-ent) that requires a corrective patch release.**

**We recommend that customers avoid using these versions in production environments and wait for the upcoming patch release.**

**Customers who have upgraded to these versions should temporarily revert to the previous stable release while we prepare a corrected update.**

A new patched release is expected by the end of the this month.

**Further updates will be shared once the new version is available. We apologize for the inconvenience and appreciate your patience.**


##### 1.22.4 (February 18, 2026)

SECURITY:
* security: upgrade go version to 1.25.7 [[GH-23204](https://github.com/hashicorp/consul/issues/23204)]
* dockerfile: the Consul build Go base image to `alpine3.23` [[GH-23194](https://github.com/hashicorp/consul/issues/23194)]
* connect: Migrate to aws-sdk-go-v2 from aws-sdk-go (v1). Also updated consul-awsauth and go-secure-stdlib/awsutil dependencies to their v2 versions. [[GH-23109](https://github.com/hashicorp/consul/issues/23109)]
* security: Configure HTTP server timeouts to prevent Slowloris denial-of-service attacks on agent HTTP endpoints and pprof endpoints. [[GH-22739](https://github.com/hashicorp/consul/issues/22739)]

IMPROVEMENTS:
* api-gateway: Fixed "duplicate matcher" errors in Envoy when using multiple file-system certificates on a single TLS listener. The certificates are now consolidated into a single filter chain, allowing Envoy to select the correct one. [[GH-23212](https://github.com/hashicorp/consul/issues/23212)]
* agent: Fix vault provider failure when signing intermediate CA with isCA=true in CSR [[GH-23202](https://github.com/hashicorp/consul/issues/23202)]
* cli: Added `--aws-iam-endpoint` flag to `consul login` command for AWS IAM auth method to support custom IAM endpoint configuration [[GH-23109](https://github.com/hashicorp/consul/issues/23109)]
* api: Cancel context check for watches cache fetch to stop execution when manager deregisters the watch. [[GH-23157](https://github.com/hashicorp/consul/pull/23157)]

### v1.22.3

- Date: 2026-01-23
- Version: v1.22.3
- Original notes: https://github.com/hashicorp/consul/releases/tag/v1.22.3
- Permalink: https://whatsnew.fyi/product/consul/releases/v1.22.3

- **security** — Update the Consul Build Go base image to alpine3.23.2
- **added** — Add consul services imported-services command and /v1/exported-services API endpoint to list services imported by partitions within a local datacenter
- **added** — Add ability to configure Virtual IP range for transparent proxy with CIDRs

##### 1.22.3 (January 23, 2026)

SECURITY:

* Update the Consul Build Go base image to `alpine3.23.2` [[GH-23138](https://github.com/hashicorp/consul/issues/23138)]

IMPROVEMENTS:

* api: Add `consul services imported-services` and new api(/v1/exported-services) command to list services imported by partitions within a local datacenter [[GH-12045](https://github.com/hashicorp/consul/issues/12045)]
* connect: added ability to configure Virtual IP range for t-proxy with CIDRs [[GH-23085](https://github.com/hashicorp/consul/issues/23085)]