Consul v2.0.3

2.0.3 (August 7, 2026)

SECURITY:

• Update brace-expansion to address GHSA-rgw5-rvv9-x895 (DoS via unbounded intermediate arrays). [GH-23786]
• Update fast-uri to address GHSA-7p8r-x3mc-p8w7 (Host Confusion via backslash authority introducer). [GH-23786]
• Update golang.org/x/text to v0.39.0 to address GO-2026-5970. [GH-23761]
• Update google.golang.org/grpc to v1.82.1 to address GHSA-hrxh-6v49-42gf. [GH-23761]
• Update socket.io-parser to address CVE-2026-69185 (Zero-attachment Memory Exhaustion). [GH-23786]
• Upgrade to use Go 1.26.5. This resolves vulnerabilities GO-2026-4970 (os). GO-2026-5856 (crypto/tls). [GH-23761]
• agent: Fixed a denial-of-service vulnerability where GET /v1/agent/connect/ca/roots and POST /v1/agent/connect/authorize used the agent-side cache unconditionally, even when http_config { use_cache = false } was configured by the operator. A remote caller could bypass this setting and grow the agent cache without bound by varying the request ACL token. Both endpoints now skip the cache and issue a direct RPC when use_cache is disabled. (SECVULN-50292, SECVULN-50293) [GH-23797]
• agent: Fixed a nil-pointer dereference panic in ShadowServiceRouterConfigEntry.CheckEnt when a service-router config entry contained a route with a nil Destination. A crafted snapshot restore or replication message containing such an entry could crash the FSM decode path. The nil guard now treats a missing destination as non-enterprise data and continues decoding safely. (SECVULN-50291) [GH-23797]
• agent: Fixed a security bypass where a user-supplied public listener (envoy_public_listener_json) with an HTTP Connection Manager filter would skip Consul's inbound request-normalization defaults. An attacker could exploit the un-normalized path to bypass L7 intention deny rules using percent-encoded path equivalents. Consul now injects path normalization (enabled by default, unless the mesh config option InsecureDisablePathNormalization is set) on every HCM filter chain in user-provided public listeners before L7 intention enforcement is applied. (SECVULN-50295) [GH-23797]
• agent: Fixed an unauthenticated denial-of-service vulnerability where PUT /v1/agent/check/update/:id, PUT /v1/agent/check/register, PUT /v1/agent/service/register, and POST /v1/agent/connect/authorize decoded unbounded JSON request bodies before resolving the caller's ACL token. An unauthenticated caller could retain multiple large JSON decoder buffers concurrently inside the Consul process before each request was rejected with HTTP 403, causing attacker-controlled heap growth. All four endpoints now cap the request body at 512 KiB before any decoding occurs, returning HTTP 413 for oversized bodies. This limit applies to chunked transfer encoding as well as declared Content-Length. (SECVULN-50418) [GH-23796]
• agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP before any request processing, ACL check, or rate limiting could occur. A remote attacker could exhaust agent file descriptors, goroutines, and memory by opening many connections and withholding the gRPC or TLS handshake. A new per-client-IP connection limiter is now applied before the gRPC server observes the connection, controlled by the new limits.grpc_max_conns_per_client configuration option (default 100). The gRPC handshake timeout has also been reduced from the library default of 120 seconds to 20 seconds. (SECVULN-50294) [GH-23797]

IMPROVEMENTS:

• ui: migrate yadda/Gherkin acceptance tests to native QUnit (harness, intentions/create, components, settings) [GH-23741]
• xds: Add two new opt-in ProxyDefaults.spec.config keys for controlling the server response header on API Gateway HTTP listeners: envoy_suppress_envoy_headers (removes the header entirely) and envoy_server_header_name (renames it to a custom value). If both are set, suppress takes precedence. [GH-13027]

BUG FIXES:

• agent: Stop logging the raw ACL token in debug-level content-type logs. [GH-23731]
• api-gateway: Fixed a regression that caused an HTTP API gateway to reject its configuration with an "inconsistent protocols" error (resulting in intermittent 503s) when a backend service's service-router composed a route to a destination in a different service, namespace, or partition during discovery-chain synthesis. [GH-23793]
• serf: Fix WAN flood-join to ignore non-alive destination members (leaving/left/failed), allowing rejoined servers to heal back to alive in WAN membership. [GH-23709]
• xds: Addition of XFCC headers to GPRC request similar to HTTP request for connect-proxy inbound listener [GH-23744]