HashiCorp memberlist CVE-2026-14362

The attacker must have TCP or UDP network connectivity to the gossip port on the target node (commonly port 8301 in Consul-based deployments, or the port configured via memberlist's BindPort setting). No application-level authentication or credential is required to send a push/pull message once the port is reachable - the vulnerability triggers during protocol-level message parsing before any cluster membership verification occurs. Exploitation is limited by: (1) network-level access controls that most production deployments enforce (gossip port firewalled to cluster subnet), (2) the requirement to initiate a valid push/pull handshake (not a simple UDP reflection), and (3) the impact being limited to the individual node's process - other cluster nodes are not directly compromised, though loss of enough nodes can degrade quorum. Non-default gossip encryption (memberlist encrypt_key / Consul gossip encryption) does NOT mitigate this vulnerability because the memory exhaustion occurs during payload processing, not before decryption.

The vendor-assigned CVSS 3.1 score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) reflects that reaching the gossip port is treated as a high-privilege condition, suppressing an otherwise network-exploitable, no-interaction, high-availability-impact flaw. This assessment may be conservative: the gossip protocol itself does not require application-level credential authentication; the PR:H appears to model the typical deployment posture where the gossip port is firewalled to cluster members rather than any built-in auth gate. An independent assessment placing PR:N would yield CVSS 7.5 (High), which arguably better reflects the technical reality once the port is reachable. No EPSS data was provided in the intelligence input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. No POC is confirmed. Real-world priority is moderate-to-high for operators exposing the gossip port to less-trusted networks (e.g., multi-tenant environments or misconfigured peering), and lower for operators with strict internal-only gossip port controls. The CVSS vendor score versus independent assessment discrepancy should be verified against the HashiCorp advisory.

An attacker with network access to the memberlist gossip port initiates a push/pull state exchange with a target node and sends a crafted, oversized state payload containing a large number of membership records. Because the receiving node imposes no allocation ceiling while processing the stream, it continuously allocates memory until heap exhaustion causes the Go runtime to terminate the process, taking the cluster node offline. No public exploit code is confirmed, but the technique is straightforward for any developer familiar with the memberlist push/pull wire format.