CVE-2026-14362

Denial of service via crafted push/pull gossip message in memberlist

Published Jul 8, 2026 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Description

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Analysis

Technical impact

HashiCorp memberlist before version 0.6.0 contains a flaw in its push/pull state handling that allows an attacker to send a crafted gossip message. The vulnerable code can deplete the receiving node’s memory, causing the memberlist process to terminate and the node to become inoperative.

Affected Systems

The vulnerability affects HashiCorp memberlist versions prior to 0.6.0. Any deployment using the shared library in these releases is potentially exposed.

Risk and Exploitability

The CVSS score of 4.9 indicates a moderate severity impact. The EPSS score is < 1%, indicating a very low exploitation probability. While no exploitation data is available and the vulnerability is not listed in CISA KEV, the attack vector is inferred to be network‑based, requiring an attacker to access the gossip port. An adversary who can reach that port can trigger memory exhaustion to cause a denial of service on the target node.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HashiCorp

Shared library

unaffected

Version	Status	Constraints
`0.1.5`	affected	< 0.6.0

No data.

Vendor Product Versions

Hashicorp

Shared Library

Version	Status	Scheme	Platform
`[0.1.5,0.6.0)`	affected	semver	['64_bit', '32_bit', 'x86', 'arm', 'macos', 'windows', 'linux']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to memberlist 0.6.0 or later to eliminate the memory exhaustion bug.
Configure firewall rules to restrict access to the gossip port only to trusted internal hosts, limiting the potential for an usage and set alerts for sudden spikes, which may indicate an attempted denial‑of‑service attack.
Monitor the memberlist process memory usage and set alerts for abnormal consumption patterns.

Generated by OpenCVE AI on August 1, 2026 at 15:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.251% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556
https://nvd.nist.gov/vuln/detail/CVE-2026-14362
https://www.cve.org/CVERecord?id=CVE-2026-14362

History

Jul 10, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-14362 https://www.cve.org/CVERecord?id=CVE-2026-14362
Metrics	threat_severity `None`	threat_severity `Important`

Jul 8, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 8, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hashicorp Hashicorp shared Library
Vendors & Products		Hashicorp Hashicorp shared Library

Jul 8, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.
Title		Denial of service via crafted push/pull gossip message in memberlist
Weaknesses		CWE-770
References		https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`