Vulnerability · Published Jul 8, 2026 · Assigned by HashiCorp
CVE-2026-14362Denial of service via crafted push/pull gossip message in memberlist
Medium 4.9
In plain English
A medium-severity resource allocation without limits in Shared library from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 83.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Shared library | 0.1.5 – before 0.6.0 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H