RepoJournal
HashiCorp @hashicorp
126 wires and counting

$ follow HashiCorp

Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-09
stories 5
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

CONSUL-K8S PATCHES TORNADO COOKIE INJECTION FLAW

By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology

Surabhi-1605
1 person shipped this
Surabhi-1605 @Surabhi-1605 1 cited

Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer.

Consul-K8s upgraded Tornado from 6.3.2 to 6.5.5 to patch GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) [1], a CWE-159 improper input handling flaw that allows attackers to inject malicious cookie attributes. This affects the control-plane gateway API stack and hits your security boundary if you're running Consul service mesh on Kubernetes. The fix is already merged [2] — it's a straightforward dependency bump with no breaking changes. Meanwhile, three nightly snapshots dropped across the Nomad ecosystem [3][4][5], but these are development builds for testing only and not recommended for production. The real story is Consul-K8s: patch before your next gateway deployment.

$ ls hashicorp/reviews/ # the step-back reads

the week in review Consul enables post-quantum key exchange by default the month in review Terraform providers widen AWS, Azure, and Google coverage while core clears Graph cruft
Topics: Go Infrastructure Full archive → Weekly reviews →

Quick answers

What shipped in HashiCorp on May 9, 2026?
Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer. In total, 1 commits, 1 pull requests, and 3 releases landed.
Who contributed to HashiCorp on May 9, 2026?
1 developer shipped this update, including Surabhi-1605.
What were the notable HashiCorp updates?
security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536) (#5297), security: upgrade tornado 6.3.2 -> 6.5.5 to fix GHSA-fqwm-6jpj-5wxc (CVE-2026-35536), and nightly.
♥

$ log @hashicorp --recent

HashiCorp: no material update 2 shipped Terraform policy 0.3 docs land, Nomad 2.0.7 docs publish 23 shipped Alicloud plugin clears Dependabot backlog, Packer patches M5 crash 14 shipped Consul turns on post-quantum key exchange by default 50 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.