Infrastructure
Consul: supported versions and open vulnerabilities today
Consul 2.0, 1.22 and 1.21 are supported (1.22 until Oct 31, 2026); 1.20 reached end of life on May 24, 2026; the latest release is 2.0.4. No high or critical advisories for Consul were published in the last 12 months (3 lower-severity); none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV and deps.dev.
- Latest release
- 2.0.4
- GitHub stars
- 30.1k
- OpenSSF Scorecard
- 7.5 / 10
Supported versions
Security advisories
3 advisories published in the last 12 months. 32 in total since records began. Checked packages: github.com/hashicorp/consul.
Licence
Consul is source-available (BUSL 1.1) since 1.17
HashiCorp moved from MPL 2.0 to the Business Source License 1.1 in August 2023. Running it for your own infrastructure is allowed; offering a competing hosted or embedded product is not.
Maintenance and supply chain
OpenSSF Scorecard 7.5 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 2 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- No static analysis (SAST 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
Alternatives
Istio
Service mesh for observability and security
Strengths
- Comprehensive feature set
- Strong security (mTLS)
Trade-offs
- Complex to operate
- High resource overhead
Linkerd
Lightweight service mesh for Kubernetes
Strengths
- Simpler than Istio
- Lower resource usage
Trade-offs
- Kubernetes-only
- Fewer features than Istio
Kuma
Universal service mesh built on Envoy
Strengths
- Platform-agnostic (Kubernetes, VMs, multi-cloud)
- Built on proven Envoy proxy
Trade-offs
- Younger project with smaller community
- Less battle-tested than Istio
AWS App Mesh
AWS-managed service mesh built on Envoy
Strengths
- Fully managed by AWS (no control plane management)
- Deep integration with AWS services (ECS, EKS, Fargate)
Trade-offs
- AWS vendor lock-in
- Limited to AWS ecosystem
Docs and release notes
Check Consul in your own stack
This page checks Consul in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.