CVE-2025-11374: Consul key/value endpoint is vulnerable to denial of service

The vulnerability is a denial-of-service (DoS) in the Consul KV endpoint caused by improper validation of the Content-Length header in PUT requests. The analysis of the patch commit 72a358cd02533477536ad4bd2b781f520fa7fac6 reveals that the agent.HTTPHandlers.KVSPut function in agent/kvs_endpoint.go was modified to address this. The original code only checked if a provided Content-Length exceeded the maximum allowed value. It did not handle cases where the Content-Length header was missing or zero, which led to an unbounded read of the request body via io.Copy. This could be exploited to cause memory exhaustion. The fix introduces a switch statement to handle various scenarios, including using http.MaxBytesReader to enforce a size limit on the request body when the Content-Length is not specified. Therefore, the agent.HTTPHandlers.KVSPut function is the identified vulnerable function that would appear in a runtime profile during exploitation.