SECVULN-29092 DoS handled for kvs_endpoint.go #22916

Manishakumari-hc · 2025-10-10T11:04:31Z

Description

Validates the content-length & req.Body conditions .
Procecces request only when :
* content-length is greater than 0 & less than int64(s.agent.config.KVMaxValueSize)
OR
* when content-length is not passed(=-1) && req.Body size is less than int64(s.agent.config.KVMaxValueSize) .
- Incase of requests with large body size or content-length the Error is thrown.

Test case:
Test case updated to check the added swich cases in KVSPUT code block .

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 · 2025-10-10T17:49:26Z

agent/kvs_endpoint.go

+			StatusCode: http.StatusRequestEntityTooLarge,
+			Reason:     fmt.Sprintf("Request body too large, max allowed is %d bytes.", maxSize),
+		}
+	}


Don't add jira tickets to oss repo prs.

sanikachavan5 · 2025-10-10T17:49:55Z

agent/kvs_endpoint.go

+			Reason:     fmt.Sprintf("Request body too large, max allowed is %d bytes.", maxSize),
+		}
+	}
+


Please add unit tests for this.

sanikachavan5 · 2025-10-10T17:50:35Z

agent/kvs_endpoint.go

-	buf := bytes.NewBuffer(nil)
-	if _, err := io.Copy(buf, req.Body); err != nil {
+	// LimitReader to limit copy of large requests with no Content-Length
+	limitedReader := io.LimitReader(req.Body, maxSize+1)


Why is maxSize+1 needed?

sanikachavan5 · 2025-10-10T17:52:09Z

agent/kvs_endpoint.go

 	}
+
+	// Reject request if actual read size exceeds allowed limit
+	if copiedBytes > maxSize {


If we are already restricting copiedBytes then why do we need this condition?

dduzgun-security

I'm not sure this resolves the issue. The problem here is when the Content-Length is omitted. The condition should check that the Content-Length is present, greater than zero and bellow the KVMaxValueSize and if not, it throws an error message. Please include unit tests to this too.

We also need a changelog for this that mentions the CVE this fix will resolve: CVE-2025-11374.

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 · 2025-10-13T09:22:14Z

agent/kvs_endpoint.go

+	maxSize := int64(s.agent.config.KVMaxValueSize)
+
+	switch {
+	case req.ContentLength < 0:


Suggested change

case req.ContentLength < 0:

case !req.ContentLength || req.ContentLength <= 0:

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 · 2025-10-13T10:30:42Z

CHANGELOG.md

+
+SECURITY:
+
+* security: Fix Consul's KV endpoint is vulnerable to denial of service address CVE-2025-11374 [[GH-22916](https://github.com/hashicorp/consul/pull/22916)]


This is not where we add changelog.

sanikachavan5 · 2025-10-13T10:31:30Z

agent/kvs_endpoint.go

+	maxSize := int64(s.agent.config.KVMaxValueSize)
+
+	switch {
+	case req.ContentLength <= 0:


Check if contentlength is omitted. If omitted, raise error

In the case of no content-length it is taken as content-lenth=-1 .So it is handled here @sanikachavan5

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 · 2025-10-13T11:52:34Z

.changelog/22916.txt

@@ -0,0 +1,3 @@
+```release-note:security
+security: Consul's KV endpoint is vulnerable to denial of service [CVE-2025-11374]()


Improved validation of the Content-Length header in the Consul KV endpoint to prevent potential denial of service attacks.

Signed-off-by: Manisha Kumari <[email protected]>

Manishakumari-hc · 2025-10-13T18:09:42Z

I'm not sure this resolves the issue. The problem here is when the Content-Length is omitted. The condition should check that the Content-Length is present, greater than zero and bellow the KVMaxValueSize and if not, it throws an error message. Please include unit tests to this too.

We also need a changelog for this that mentions the CVE this fix will resolve: CVE-2025-11374.

@eastebry There is no URL for this CVE yet. Do you want me to modify the changelog ?

eastebry

Thanks for making this change!

I believe this check is correct, and this will fix this issue (more details on that at the bottom), however I am wondering if we would be better off using a MaxByteReader to read the body and enforce the limit. There may be trade offs to this approach, so I'll leave the final decision to you all.

Regarding this specific check, I believe this is correct. Here are the cases I was concerned about and explicitly tested:

If a Content-Length header is not set, it appears that Go will infer based on the body, or set it to -1 if the request is chunked.
If Content-Length is set to a different value than the size of the body, the server will either truncate the body, or hang while it waits for the additional bytes to be sent.

Based on that, this code appears to work properly. I do wonder if we would be better off not performing this check ourselves, and relying on a MaxByteReader.

Signed-off-by: Manisha Kumari <[email protected]>

Manishakumari-hc · 2025-10-13T19:08:15Z

Thanks for making this change!

I believe this check is correct, and this will fix this issue (more details on that at the bottom), however I am wondering if we would be better off using a MaxByteReader to read the body and enforce the limit. There may be trade offs to this approach, so I'll leave the final decision to you all.

Regarding this specific check, I believe this is correct. Here are the cases I was concerned about and explicitly tested:

If a Content-Length header is not set, it appears that Go will infer based on the body, or set it to -1 if the request is chunked.

If Content-Length is set to a different value than the size of the body, the server will either truncate the body, or hang while it waits for the additional bytes to be sent.

Based on that, this code appears to work properly. I do wonder if we would be better off not performing this check ourselves, and relying on a MaxByteReader.

Updated to MaxByteReader

addressed the change and other reviewrs have reviewd.

hc-github-team-consul-core · 2025-10-15T09:23:41Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-16T09:23:45Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-17T09:24:13Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-18T09:22:13Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-19T09:21:33Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

hc-github-team-consul-core · 2025-10-21T09:23:32Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

sarah-oloumi · 2025-10-21T12:47:25Z

@dduzgun-security Where is CVE-2025-11374 coming from? I'm reading the release notes for the pre-release and when googling CVE-2025-11374 I don't see anything. Is this a consul specific CVE? There is not even a NIST page on it... https://nvd.nist.gov/vuln/detail/CVE-2025-11374 leads to nothing

Same thing for https://nvd.nist.gov/vuln/detail/CVE-2025-11375 and for https://nvd.nist.gov/vuln/detail/CVE-2025-11392 @hc-github-team-consul-core

How can we get more info on the CVSS for these CVEs?

dduzgun-security · 2025-10-21T13:33:53Z

Hi @sarah-oloumi , the CVE is reserved by us under the HashiCorp CNA and will be published at the same time as the next Consul release of version 1.22.

hc-github-team-consul-core · 2025-10-23T09:26:13Z

📣 Hi @Manishakumari-hc! a backport is missing for this PR [22916] for versions [1.18,1.19,1.20,1.21] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

SECVULN-29092 Dos handled

635cda0

Signed-off-by: Manisha Kumari <[email protected]>

Manishakumari-hc requested a review from dduzgun-security October 10, 2025 11:04

Manishakumari-hc requested review from a team as code owners October 10, 2025 11:04

Manishakumari-hc changed the title ~~SECVULN-29092 Dos handled~~ SECVULN-29092 DOS handled Oct 10, 2025

Manishakumari-hc changed the title ~~SECVULN-29092 DOS handled~~ SECVULN-29092 DoS handled for kvs_endpoint.go Oct 10, 2025

Manishakumari-hc added backport/all Apply backports for all active releases per .release/versions.hcl pr/no-changelog PR does not need a corresponding .changelog entry labels Oct 10, 2025

Manishakumari-hc self-assigned this Oct 10, 2025

SECVULN-29092 Dos handled

14f630c

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 requested changes Oct 10, 2025

View reviewed changes

dduzgun-security previously requested changes Oct 10, 2025

View reviewed changes

Error handling for request with no content-length

9ebb5e0

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 requested changes Oct 13, 2025

View reviewed changes

Error handling for request with no content-length

db69840

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 requested changes Oct 13, 2025

View reviewed changes

addressed changelog

b8fa0b4

Signed-off-by: Manisha Kumari <[email protected]>

sanikachavan5 requested changes Oct 13, 2025

View reviewed changes

Manishakumari-hc removed the pr/no-changelog PR does not need a corresponding .changelog entry label Oct 13, 2025

Manishakumari-hc added 4 commits October 13, 2025 17:31

addressed changelog

6ed93a9

Signed-off-by: Manisha Kumari <[email protected]>

changed variable scope

ebec61b

Signed-off-by: Manisha Kumari <[email protected]>

handle requests with no content-length and allowed size

37727e3

Signed-off-by: Manisha Kumari <[email protected]>

handle validations of content length

3a0d477

Signed-off-by: Manisha Kumari <[email protected]>

Manishakumari-hc requested a review from eastebry October 13, 2025 18:04

eastebry previously approved these changes Oct 13, 2025

View reviewed changes

changed byteReader to maxByteReader

870f498

Signed-off-by: Manisha Kumari <[email protected]>

Manishakumari-hc dismissed eastebry’s stale review via 870f498 October 13, 2025 19:06

Manishakumari-hc enabled auto-merge (squash) October 14, 2025 16:49

Manishakumari-hc requested review from dduzgun-security, eastebry, sanikachavan5 and santoshpulluri October 14, 2025 16:49

eastebry approved these changes Oct 14, 2025

View reviewed changes

sanikachavan5 approved these changes Oct 14, 2025

View reviewed changes

sanikachavan5 added backport/ent/1.18 Changes are backported to 1.18 ent backport/ent/1.20 backport to ent 1.20 backport/ent/1.21 changes are backported to 1.21 ent backport/1.22 Changes are backported to 1.22 labels Oct 14, 2025

Manishakumari-hc removed the request for review from dduzgun-security October 14, 2025 16:59

Manishakumari-hc merged commit 72a358c into main Oct 14, 2025
189 of 195 checks passed

hc-github-team-consul-core added backport/1.21 This release series is longer active on CE, use backport/ent/1.21 backport/ent/1.19 Changes are backported to 1.19 ent labels Oct 14, 2025

hc-github-team-consul-core mentioned this pull request Oct 14, 2025

Backport of SECVULN-29092 DoS handled for kvs_endpoint.go into release/1.21.x #22943

Merged

sanikachavan5 added backport/1.22 Changes are backported to 1.22 and removed backport/1.22 Changes are backported to 1.22 labels Oct 14, 2025

hc-github-team-consul-core mentioned this pull request Oct 14, 2025

Backport of SECVULN-29092 DoS handled for kvs_endpoint.go into release/1.22.x #22944

Merged

GoVulnBot mentioned this pull request Oct 29, 2025

x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-7g3r-8c6v-hfmr golang/vulndb#4081

Closed

	case req.ContentLength < 0:
	case !req.ContentLength \|\| req.ContentLength <= 0:


		SECURITY:

		* security: Fix Consul's KV endpoint is vulnerable to denial of service address CVE-2025-11374 [[GH-22916](https://github.com/hashicorp/consul/pull/22916)]

		@@ -0,0 +1,3 @@
		```release-note:security
		security: Consul's KV endpoint is vulnerable to denial of service [CVE-2025-11374]()

SECVULN-29092 DoS handled for kvs_endpoint.go #22916

SECVULN-29092 DoS handled for kvs_endpoint.go #22916

Conversation

Manishakumari-hc commented Oct 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dduzgun-security left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Manishakumari-hc Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Manishakumari-hc commented Oct 13, 2025

Uh oh!

eastebry left a comment

Choose a reason for hiding this comment

Uh oh!

Manishakumari-hc commented Oct 13, 2025

Uh oh!

Uh oh!

hc-github-team-consul-core commented Oct 15, 2025

Uh oh!

hc-github-team-consul-core commented Oct 16, 2025

Uh oh!

hc-github-team-consul-core commented Oct 17, 2025

Uh oh!

hc-github-team-consul-core commented Oct 18, 2025

Uh oh!

hc-github-team-consul-core commented Oct 19, 2025

Uh oh!

hc-github-team-consul-core commented Oct 21, 2025

Uh oh!

sarah-oloumi commented Oct 21, 2025

Uh oh!

dduzgun-security commented Oct 21, 2025

Uh oh!

hc-github-team-consul-core commented Oct 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Manishakumari-hc commented Oct 10, 2025 •

edited

Loading

Manishakumari-hc Oct 13, 2025 •

edited

Loading