●Change8

v2.0.3

Breaking Changes
📦 consul-connectView on GitHub →
⚠ 2 breaking✨ 1 features🐛 14 fixes🔧 19 symbols

Summary

This release addresses multiple security vulnerabilities by updating dependencies and patching agent behavior. It also includes improvements to the xDS configuration and bug fixes for the API gateway, serf, and agent logging.

⚠️ Breaking Changes

  • agent: The `GET /v1/agent/connect/ca/roots` and `POST /v1/agent/connect/authorize` endpoints now skip the agent-side cache and issue a direct RPC when `http_config { use_cache = false }` is configured. Previously, these endpoints used the cache unconditionally, even when `use_cache` was disabled, allowing a remote caller to bypass this setting and grow the agent cache without bound by varying the request ACL token. To maintain previous behavior, ensure `http_config { use_cache = true }` or remove the setting.
  • agent: User-supplied public listeners with an HTTP Connection Manager filter will now have path normalization injected by default before L7 intention enforcement. This addresses a security bypass where attackers could exploit un-normalized paths to bypass L7 intention `deny` rules. If path normalization is not desired, set the mesh config option `InsecureDisablePathNormalization` to `true`.

Migration Steps

  1. If you previously relied on the agent-side cache being used even when `http_config { use_cache = false }` was set for `GET /v1/agent/connect/ca/roots` and `POST /v1/agent/connect/authorize`, you will need to update your configuration to `http_config { use_cache = true }` or remove the setting.
  2. If you do not want path normalization to be injected by default on user-provided public listeners with HTTP Connection Manager filters, set the mesh config option `InsecureDisablePathNormalization` to `true`.

✨ New Features

  • xds: Added two new opt-in `ProxyDefaults.spec.config` keys for controlling the `server` response header on API Gateway HTTP listeners: `envoy_suppress_envoy_headers` (removes the header entirely) and `envoy_server_header_name` (renames it to a custom value). If both are set, suppress takes precedence.

🐛 Bug Fixes

  • SECURITY: Updated `brace-expansion` to address a DoS vulnerability via unbounded intermediate arrays.
  • SECURITY: Updated `fast-uri` to address a Host Confusion vulnerability via backslash authority introducer.
  • SECURITY: Updated `golang.org/x/text` to v0.39.0 to address a vulnerability.
  • SECURITY: Updated `google.golang.org/grpc` to v1.82.1 to address a vulnerability.
  • SECURITY: Updated `socket.io-parser` to address a Zero-attachment Memory Exhaustion vulnerability.
  • SECURITY: Upgraded to Go `1.26.5` to resolve vulnerabilities in `os` and `crypto/tls`.
  • agent: Fixed a nil-pointer dereference panic in `ShadowServiceRouterConfigEntry.CheckEnt` when a service-router config entry contained a route with a nil `Destination`. The nil guard now treats a missing destination as non-enterprise data and continues decoding safely.
  • agent: Fixed an unauthenticated denial-of-service vulnerability where `PUT /v1/agent/check/update/:id`, `PUT /v1/agent/check/register`, `PUT /v1/agent/service/register`, and `POST /v1/agent/connect/authorize` decoded unbounded JSON request bodies before resolving the caller's ACL token. All four endpoints now cap the request body at 512 KiB before any decoding occurs, returning HTTP 413 for oversized bodies.
  • agent: Fixed an unauthenticated denial-of-service vulnerability where the external gRPC and gRPC-TLS listeners accepted an unlimited number of TCP connections per source IP before any request processing, ACL check, or rate limiting could occur. A new per-client-IP connection limiter is now applied before the gRPC server observes the connection, controlled by the new `limits.grpc_max_conns_per_client` configuration option (default 100). The gRPC handshake timeout has also been reduced from the library default of 120 seconds to 20 seconds.
  • ui: Migrated yadda/Gherkin acceptance tests to native QUnit (harness, intentions/create, components, settings).
  • agent: Stopped logging the raw ACL token in debug-level content-type logs.
  • api-gateway: Fixed a regression that caused an HTTP API gateway to reject its configuration with an "inconsistent protocols" error (resulting in intermittent 503s) when a backend service's `service-router` composed a route to a destination in a different service, namespace, or partition during discovery-chain synthesis.
  • serf: Fixed WAN flood-join to ignore non-alive destination members (leaving/left/failed), allowing rejoined servers to heal back to alive in WAN membership.
  • xds: Added XFCC headers to GPRC request similar to HTTP request for connect-proxy inbound listener.

Affected Symbols

brace-expansionfast-urigolang.org/x/textgoogle.golang.org/grpcsocket.io-parseroscrypto/tlsGET /v1/agent/connect/ca/rootsPOST /v1/agent/connect/authorizeShadowServiceRouterConfigEntry.CheckEntPUT /v1/agent/check/update/:idPUT /v1/agent/check/registerPUT /v1/agent/service/registerPOST /v1/agent/connect/authorizelimits.grpc_max_conns_per_clientProxyDefaults.spec.configenvoy_suppress_envoy_headersenvoy_server_header_nameconnect-proxy inbound listener