What is the CVSS score of CVE-2026-14362?

CVE-2026-14362 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-14362?

Yes, a patch is available for CVE-2026-14362. Update the affected software to the latest version immediately.

HashiCorp memberlist CVE-2026-14362

EUVD-2026-42342 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-08 HashiCorp

GHSA-6r3r-6rpf-v429

Hashicorp Denial Of Service Shared Library Red Hat Suse

4.9

CVSS 3.1 · Vendor: HashiCorp

Severity by source

Vendor (HashiCorp) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Gossip port requires no application-level authentication; PR:N reflects the technical exploit path once the port is network-reachable, independent of deployment-level firewall controls.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (HashiCorp).

CVSS VectorVendor: HashiCorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 08, 2026 - 19:01 EUVD

Analysis Generated

Jul 08, 2026 - 17:54 vuln.today

DescriptionCVE.org

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

AnalysisAI

Memory exhaustion in HashiCorp memberlist before 0.6.0 allows network-accessible attackers to crash individual cluster nodes by sending crafted push/pull state synchronization messages to the gossip port, triggering unbounded memory allocation until the process terminates. The vulnerability is rooted in missing resource limits on incoming gossip state payloads (CWE-770). No public exploit code exists and CISA KEV listing is not confirmed; however, because memberlist underpins HashiCorp Consul, Nomad, and Vault cluster communication, a single exploitable node crash can disrupt distributed coordination in dependent systems.

Technical ContextAI

HashiCorp memberlist is a Go library implementing the SWIM gossip protocol for cluster membership and failure detection, used internally by Consul, Nomad, Vault, and other HashiCorp products. The push/pull state mechanism is how nodes synchronize full membership state with peers - a receiving node accepts a stream of state data from a remote peer, processes it, and merges it locally. CWE-770 (Allocation of Resources Without Limits or Throttling) is the root cause class: the receiving node does not enforce any cap on the amount of memory it allocates while processing an incoming push/pull payload, allowing a malicious sender to supply an arbitrarily large message that exhausts heap memory. The affected CPE is cpe:2.3:a:hashicorp:shared_library:*:*:*:*:*:*:*:*, covering all memberlist releases prior to 0.6.0. The gossip port is typically UDP/TCP 8301 (Consul LAN serf) or a configurable equivalent, exposed only within the cluster network in standard deployments.

RemediationAI

Upgrade to HashiCorp memberlist 0.6.0, which is confirmed as the fix version per the HashiCorp advisory at https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556. For applications embedding memberlist as a Go dependency, update the go.mod entry and rebuild. If an immediate upgrade is not possible, restrict access to the gossip port using host-based firewalls or network ACLs so that only known, trusted cluster peers can reach it - this eliminates the attack surface for external or untrusted nodes but does not protect against a compromised cluster member. Note that blocking the gossip port broadly will prevent cluster membership synchronization and may itself cause availability degradation; the port restriction must be scoped precisely to untrusted sources. No other workarounds are documented in the available advisory.

More in Shared Library

View all

CVE-2026-8052 MEDIUM This Month

6.0 May 12

Arbitrary file read and write on the Nomad client host is achievable through a symlink attack in HashiCorp Nomad's exec2

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2025-41770 HIGH

8.7

CVE-2025-26466 MEDIUM

5.9

CVE-2020-37067 CRITICAL POC

9.8

CVE-2021-47875 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 12	Affected
SUSE Linux Enterprise High Performance Computing 12	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected

CVE-2026-14362 vulnerability details – vuln.today

Back

HashiCorp memberlist CVE-2026-14362

Severity by source

CVSS VectorVendor: HashiCorp

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Shared Library

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code