CVE catalog

CVE-2025-11375

UBUNTU-CVE-2025-11375

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Oct 28, 2025, 8:12:14 PM UTC
Updated: Aug 27, 2026, 11:05:22 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.43% · Oct 25, 2026

Consul and Consul Enterprise’s (“Consul”) event endpoint is vulnerable to denial of service (DoS) due to lack of maximum value on the Content Length header. This vulnerability, CVE-2025-11375, is fixed in Consul Community Edition 1.22.0 and Consul Enterprise 1.22.0, 1.21.6, 1.20.8 and 1.18.12.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	consul	11	`1.10.12+dfsg1-1`	vulnerable
Debian	consul	11	`1.8.7+dfsg1-2`	vulnerable
Debian	consul	11	`1.8.7+dfsg1-3`	vulnerable
Debian	consul	11	`1.8.7+dfsg1-4`	vulnerable
Debian	consul	11	`1.8.7+dfsg1-5`	vulnerable
Debian	consul	11	`1.8.7+dfsg1-6`	vulnerable
Debian	consul	11	`1.9.17+dfsg2-1`	vulnerable
Ubuntu	consul	18.04	`0.6.4~dfsg-3`	vulnerable
Ubuntu	consul	20.04	`1.0.7~dfsg1-5ubuntu1`	vulnerable
Ubuntu	consul	20.04	`1.4.4~dfsg1-2ubuntu2`	vulnerable
Ubuntu	consul	20.04	`1.5.2+dfsg1-6`	vulnerable
Ubuntu	consul	20.04	`1.5.2+dfsg1-10`	vulnerable
Ubuntu	consul	20.04	`1.5.2+dfsg1-12`	vulnerable
Ubuntu	consul	20.04	`1.5.2+dfsg2-14`	vulnerable
Ubuntu	consul	22.04	`1.7.4+dfsg1-1`	vulnerable
Ubuntu	consul	22.04	`1.8.7+dfsg1-3`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 24, 2026, 4:58:38 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]