Service mesh and service discovery tool
npx @buildinternet/releases get consulConnect sidecar proxies and terminating gateways now receive leaf certificates and CA roots over SDS instead of inline in the listener filter chain, so leaf rotation no longer changes the filter chain hash and established connections (including long-lived TCP sessions) are not drained. Also fixes two proxycfg goroutine and memory leaks and restores Raft, Serf, and Memberlist metrics by building with the hashicorpmetrics tag.
The consul connect redirect-traffic command and transparent proxy redirection now use nftables instead of iptables/ip6tables, requiring the nft binary and Linux kernel 5.2 or later, with no automatic fallback; the official container image now ships nftables in place of iptables. API Gateway listeners also accept http2 and grpc protocols, enabling end-to-end HTTP/2 and gRPC instead of silently downgrading to HTTP/1.1.
Fixes a pre-authorization memory exhaustion vulnerability where an mTLS-authenticated RPC client with no ACL token could OOM-kill a Consul server with an oversized MessagePack header, plus an incorrect authorization vulnerability letting local tokens delete peer-imported catalog objects. Also requires mesh:write in addition to service:write for attaching code-executing EnvoyExtensions and proxy escape-hatch keys, and upgrades Go, golang.org/x/mod, x/crypto, and x/net to address security vulnerabilities.
v2.0.3 addresses six security issues, including a cache-based DoS on connect endpoints, an unauthenticated heap-exhaustion via unbounded JSON bodies (now capped at 512 KiB), and an unbounded-connection DoS on gRPC listeners (new per-client-IP limiter, default 100). Also fixed a nil-pointer panic, a Gateway 503 regression, and a token-leak logging issue.
Upgraded Alpine base image to 3.24 to address CVE-2026-41989 and ALPINE-CVE-2026-2100, and upgraded Serf and Memberlist to their latest versions. XDS now returns errors when injecting L4 intention (RBAC) filter or mTLS transport socket onto inbound public listeners without enforcement, preventing listeners from being served without intention enforcement or mTLS. Also added ExtAuthzFilter support to HTTPRoute Filters and gateway-wide ExtAuthz toggle for api-gateway (Enterprise only), and External Processor (ext_proc) Envoy Extension support for api-gateway and connect-proxy (Enterprise only).
Fixed a bug where renaming or rejoining a server could evict the live leader from the internal server lookup, causing Raft leader errors on follower RPCs. Inbound HTTP requests now have the x-forwarded-client-cert header stripped before forwarding to local services. Also includes Go and Envoy security upgrades, OIDC/JWT claim mapping support for auth method token names, and product telemetry export cadence preservation across restarts.
Applied HTTP request path normalization on API Gateway and Terminating Gateway listeners to prevent L7 intention RBAC bypass via non-normalized paths (CVE-2024-10005). Enterprise deployments gain a new "rate-limit" config entry that enables dynamic, cluster-wide RPC rate limiting stored in Raft and automatically replicated to all servers. Also upgraded Envoy to 1.37.2, Go to 1.26, and patched multiple curl CVEs in the Docker container image.
Fixed CVE-2024-10005, an L7 intention RBAC bypass via non-normalized HTTP request paths on api-gateway and terminating-gateway listeners. Also fixed transaction endpoint authorization bypasses where service and check mutations could be authorized using request-provided names while applying changes by ID, including a bypass using the reserved consul service name. Increased default HTTP timeouts to 15 minutes to support long-polling blocking queries while maintaining Slowloris protection.
⚠️ Important Notice
We have identified an issue in Consul and Consul Enterprise Feb Patch Release (1.22.4, 1.22.4-ent, 1.21.10-ent, 1.18.20-ent) that requires a corrective patch release.
**We recommend that customers avoid using these versions in production…
SECURITY:
alpine3.23.2 [GH-23138]IMPROVEMENTS:
consul services imported-services and new api(/v1/exported-services) command to…