Who contributed to HashiCorp on May 9, 2026?

1 developer shipped this update, including Surabhi-1605.

What were the notable HashiCorp updates?

security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) (#5297), security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536), and nightly.

@hashicorp

Terraform, Vault, Consul - infra-as-code for ops teams

github ↗

Pick a date

Topics: Go Infrastructure Full archive →

The Wire · Showcase

CONSUL-K8S PATCHES TORNADO COOKIE INJECTION FLAW

By RepoJournal · Filed 06:01 UTC on May 9, 2026 · About HashiCorp

1 person shipped this

Surabhi-1605 @Surabhi-1605 1 cited

Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer.

Consul-K8s upgraded Tornado from 6.3.2 to 6.5.5 to patch GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) [1], a CWE-159 improper input handling flaw that allows attackers to inject malicious cookie attributes. This affects the control-plane gateway API stack and hits your security boundary if you're running Consul service mesh on Kubernetes. The fix is already merged [2] — it's a straightforward dependency bump with no breaking changes. Meanwhile, three nightly snapshots dropped across the Nomad ecosystem [3][4][5], but these are development builds for testing only and not recommended for production. The real story is Consul-K8s: patch before your next gateway deployment.

Action items

→ Upgrade consul-k8s to the latest patch with Tornado 6.5.5 before next production deploy hashicorp/consul-k8s [immediate]
→ Monitor your gateway API logs for any cookie-related exploits in the past 24 hours hashicorp/consul-k8s [immediate]
→ Review Nomad nightly builds if you're testing experimental features — otherwise skip hashicorp/nomad-driver-podman [monitor]

References

[1] security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) (#5297) hashicorp/consul-k8s
[2] security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) ↗ hashicorp/consul-k8s
[3] nightly ↗ hashicorp/nomad-driver-podman
[4] nightly ↗ hashicorp/nomad-autoscaler
[5] nightly ↗ hashicorp/nomad-pack

Quick answers

What shipped in HashiCorp on May 9, 2026?: Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer. In total, 1 commits, 1 pull requests, and 3 releases landed.
Who contributed to HashiCorp on May 9, 2026?: 1 developer shipped this update, including Surabhi-1605.
What were the notable HashiCorp updates?: security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) (#5297), security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536), and nightly.

TERRAFORM PROVIDERS EXPAND GOOGLE CLOUD COVERAGE AND IN-PLACE UPDATES

HashiCorp shipped in-place VCS connection updates for registry modules while Google provider gains traffic config for Vertex AI and promotes NCC gateway resources to GA.

go 19 shipped 1-min read

@hashicorp 1 day ago

VAULT LDAP GETS ON-DEMAND PASSWORD ROTATION, PACKER CUTS v1.16.0

Terraform provider for Vault now supports rotate-on-read for LDAP secrets, letting teams rotate credentials at read time instead of waiting for scheduled intervals.

go 8 shipped 1-min read

@hashicorp 2 days ago

CONSUL FIXES FLOODED MEMBER REJOIN BUG AS VSO PATCHES GRPC FRAME FLOOD

Consul patches a critical WAN flood regression that was incorrectly treating failed members as alive during rejoin sequences.

go 8 shipped 1-min read

@hashicorp 3 days ago

TERRAFORM AWS PROVIDER GAINS S3 TABLES AND OPENSEARCH FEDERATION SUPPORT

The AWS provider shipped three enhancement PRs overnight that expand infrastructure-as-code coverage for S3 Tables metadata properties and OpenSearch security configurations, while the docs team cleaned up deprecated tutorial collections and fixed formatting bugs across Vault and PKI documentation.

go 60 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.