CVE-2025-11375: Consul event endpoint is vulnerable to denial of service

The security vulnerability, CVE-2025-11375, is a denial-of-service (DoS) weakness in Consul's event endpoint. The root cause is the lack of a maximum size limit on the Content-Length header for incoming requests. The analysis of the patch commit e794201d0c618333d81ad775270f7b32801178fb clearly shows the vulnerable code and the subsequent fix.

The modified file agent/event_endpoint.go contains the HTTP handler for the event endpoint. The function agent.HTTPHandlers.EventFire is where the vulnerability lies. Before the patch, the code would check if req.ContentLength > 0 and then proceed to copy the entire request body into a bytes.Buffer. This operation is unbounded and directly tied to the client-supplied Content-Length header. An attacker could exploit this by sending a request with an extremely large Content-Length value, forcing the Consul agent to allocate an excessive amount of memory, leading to a crash and a DoS.

The patch mitigates this by introducing a constant, maxEventPayloadSize, and adding a check to ensure the Content-Length does not exceed this value. If it does, the request is rejected with an http.StatusRequestEntityTooLarge status, preventing the large memory allocation. Therefore, the agent.HTTPHandlers.EventFire function is the precise location of the vulnerability.