CVE-2026-14362 PUBLISHED

Denial of service via crafted push/pull gossip message in memberlist

Assigner: HashiCorp
Reserved: 01.07.2026 Published: 08.07.2026 Updated: 08.07.2026

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 4.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	High	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Shared library
Versions	Default: unaffected affected from 0.1.5 to 0.6.0 (excl.)

Credits

This issue was reported to HashiCorp by Andy Gill of ZephrSec.

References

https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556

Problem Types

CWE-770: Allocation of Resources Without Limits or Throttling CWE

Impacts

CAPEC-469: HTTP DoS