Multiple CVEs in consul-template v0.41.4 (CVE-2025-61726, CVE-2025-61728, CVE-2025-61730)

[stevandy]

Hi everyone,

I noticed multiple CVEs in the latest tagged v0.41.4 of consul-template:
CVE-2025-61726
CVE-2025-61728
CVE-2025-61730

Could you help with resolving these issues?

Thank you.

[oyelekci]

v0.41.4 also appears to be vulnerable to CVE-2025-68121 which is currently rated critical. Can we expect a new release soon?

[Kisan-hpe]

@sreeram77 These are critical CVE for our CI pipeline.
Any plan to provide patch for these?
CVE-2025-68121
CVE-2025-61726
CVE-2025-61728
CVE-2025-61730

[Kisan-hpe]

@sreeram77 Any plans to fix these?

[samsonifegwu]

@dev756 please any update yet on: "v0.41.4 also appears to be vulnerable to CVE-2025-68121 which is currently rated critical. Can we expect a new release soon?"

[dduzgun-security]

Hey folks, I opened #2140 to resolve the issues. For faster responses in the future, please feel free to email security@hashicorp.com

[samsonifegwu]

@dduzgun-security does that also cover to CVE-2025-68121, it wasn't listed in your PR

[dduzgun-security]

@samsonifegwu Sorry for the delayed response (I was on PTO), yes x/crypto is also bumped https://github.com/hashicorp/consul-template/pull/2140/changes#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R67

[Kisan-hpe]

HI @dduzgun-security When is plan to release new version with these CVE fixes?? as we are having critical CVEs

[jaycuse]

We are seeing 7 CVE's currently related to stdlib.
CVE-2025-68121
CVE-2025-61726
CVE-2025-61728
CVE-2026-25679
CVE-2025-61730
CVE-2026-27142
CVE-2026-27139

[Kisan-hpe]

@sreeram77 Any updates to fix these cves, Our CI pipelines are failing due to this.

[rszabo50]

@dduzgun-security i know you raised a ticket as a one off for CVE issues, but for those that rely on consul-template and have security teams hounding them a more regimented release cycle to mitigate the constant CVE's is something all would appreciate. Is there any way to get a release out now and maybe have a regular release cycle for CVE mitigation?

Something like this would allow give everyone a good feeling wrt to security as well as allow us to let the security teams know that fixes are coming with some amount of certainty.

[tgross]

Hey folks! Deniz isn't with the org anymore. The Consul team owns this repository and will definitely have an update once they're ready to release.