CVE-2022-29153 — Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Description

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 11	consul	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 22.04 LTS	consul	No fix yet	—
Ubuntu 20.04 LTS	consul	No fix yet	—
Ubuntu 18.04 LTS	consul	No fix yet	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	k3d +2	5.6.0-r11	—

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery http/cves/2022/CVE-2022-29153.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/hashicorp/consul	< 1.9.17	1.9.17	GHSA-q6h7-4qgw-2j9p
Go	github.com/hashicorp/consul	>= 1.10.0, < 1.10.10	1.10.10	GHSA-q6h7-4qgw-2j9p
Go	github.com/hashicorp/consul	>= 1.11.0, < 1.11.5	1.11.5	GHSA-q6h7-4qgw-2j9p
Go	github.com/hashicorp/consul	< 1.9.17 · >= 1.10.0, < 1.10.10 · >= 1.11.0, < 1.11.5	1.9.17, 1.10.10, 1.11.5	GO-2022-0615

Advisories 1

WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector