CVE-2021-32574

—

CVSS 3.1

7.5 high

EPSS

1%p72

Published

Jul 17, 2021 (Jul 17, 2021)

Modified

Jun 17, 2026

Description

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

Vendors: hashicorp
Products: consul
Weakness: CWE-295
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.