GHSA-q6h7-4qgw-2j9p BIT-consul-2022-29153 CVE-2022-29153 GO-2022-0615

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

High Go

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 8.75%; Chance of exploitation in the next 30 days. Higher than 95.16% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
Fix: 1.9.17; Upgrade github.com/hashicorp/consul to this version or later

Description

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/hashicorp/consul	`< 1.9.17`	`1.9.17`
github.com/hashicorp/consul	`>= 1.10.0, < 1.10.10`	`1.10.10`
github.com/hashicorp/consul	`>= 1.11.0, < 1.11.5`	`1.11.5`
github.com/hashicorp/consul	`< 1.9.17` `>= 1.10.0, < 1.10.10` `>= 1.11.0, < 1.11.5`	`1.9.17` `1.10.10` `1.11.5`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/consul Go → `1.9.17`

go

go get github.com/hashicorp/consul@v1.9.17 && go mod tidy

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Packages

github.com/hashicorp/consul

Timeline

Apr 19, 2022 Published
Sep 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-cpfq-66p2-336j Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication	Medium	Also affects github.com/hashicorp/consul
GHSA-qh7p-pfq3-677h Consul event endpoint is vulnerable to denial of service	Medium	Also affects github.com/hashicorp/consul
GHSA-7g3r-8c6v-hfmr Consul key/value endpoint is vulnerable to denial of service	Medium	Also affects github.com/hashicorp/consul
GHSA-99wr-c2px-grmh Hashicorp Consul Cross-site Scripting vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-5c4w-8hhh-3c3h Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-chgm-7r52-whjj Hashicorp Consul Path Traversal vulnerability	Medium	Also affects github.com/hashicorp/consul
GHSA-6m72-467w-94rh Privilege Escalation in HashiCorp Consul	Medium	Also affects github.com/hashicorp/consul
GHSA-496g-fr33-whrf Denial of service in HashiCorp Consul	High	Also affects github.com/hashicorp/consul

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor