CVE-2026-14362 Overview
CVE-2026-14362 is a denial-of-service vulnerability in HashiCorp memberlist versions before 0.6.0. The flaw resides in the library's push/pull state handling on the gossip protocol port. An attacker with network access to the gossip port can send crafted messages that exhaust memory on a receiving node. The targeted process terminates, disrupting cluster membership and any application relying on memberlist for gossip-based coordination. HashiCorp addressed the issue in memberlist0.6.0 as documented in the HashiCorp Security Advisory HCSEC-2026-18. The weakness maps to [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
Attackers with network reach to the gossip port can crash memberlist-backed processes, degrading availability of Consul, Nomad, Serf, and other downstream clusters.
Affected Products
- HashiCorp memberlist versions prior to 0.6.0
- Downstream projects embedding vulnerable memberlist releases (for example, Serf, Consul, Nomad)
- Any Go application importing github.com/hashicorp/memberlist before 0.6.0
Discovery Timeline
- 2026-07-08 - CVE-2026-14362 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-14362
Vulnerability Analysis
The memberlist library implements a gossip protocol for cluster membership and failure identification. Nodes exchange state through a push/pull mechanism that transmits and receives serialized node state over the network. The vulnerable code paths accept incoming push/pull payloads without sufficient bounds on the resources they allocate during parsing. A remote peer that can reach the gossip port can send messages designed to trigger large memory allocations on the receiver. Sustained or crafted traffic drives the process toward memory exhaustion, at which point the Go runtime terminates the process. Because gossip participation is a peer-to-peer function, the crash of a single node can cascade through membership churn and reconvergence.
Root Cause
The root cause is unbounded resource allocation during push/pull state decoding, classified under [CWE-770]. The library trusted attacker-controlled size fields in gossip messages when allocating buffers or state structures, and did not enforce hard limits appropriate for the transport.
Attack Vector
Exploitation requires network reachability to the memberlist gossip port and the ability to participate as a peer, which corresponds to the high privileges component reflected in the vector. No user interaction is required. The impact is confined to availability, with no confidentiality or integrity loss on the targeted node. Refer to the HashiCorp Security Advisory HCSEC-2026-18 for vendor-provided technical details.
Detection Methods for CVE-2026-14362
Indicators of Compromise
- Repeated out-of-memory terminations of processes linking memberlist, such as consul, nomad, or serf agents.
- Sudden spikes in resident memory on gossip participants immediately preceding a crash.
- Unexpected inbound traffic bursts to the gossip TCP/UDP port from non-cluster peers.
- Cluster logs showing repeated push/pull state exchange failures or protocol decode errors.
Detection Strategies
- Alert on process restarts of memberlist-based services correlated with high memory pressure.
- Inspect gossip port traffic for peers outside the expected cluster membership set.
- Monitor for anomalous memberlist log messages referencing push/pull, state decoding, or oversized payloads.
Monitoring Recommendations
- Track memory utilization and OOM kill events on all cluster nodes running memberlist-dependent services.
- Capture and retain gossip port flow records to reconstruct source addresses after an incident.
- Forward memberlist and host telemetry into a centralized analytics pipeline to correlate crashes across nodes.
How to Mitigate CVE-2026-14362
Immediate Actions Required
- Upgrade memberlist to version 0.6.0 or later in all Go modules that import the library.
- Rebuild and redeploy downstream binaries such as Consul, Nomad, and Serf using the patched memberlist release.
- Restrict network access to the gossip port so only known cluster members can connect.
- Inventory all internal services that link memberlist and prioritize those exposed to untrusted network segments.
Patch Information
The vulnerability is fixed in memberlist0.6.0. See the HashiCorp Security Advisory HCSEC-2026-18 for the authoritative fix reference. Update the module dependency, rebuild affected binaries, and roll the upgrade through the cluster.
Workarounds
- Enforce host and network firewall rules limiting the gossip port to trusted cluster CIDRs.
- Place gossip traffic on a dedicated management network isolated from user-facing systems.
- Require mutual TLS or encryption keys for gossip where supported by the downstream product to reduce anonymous peer exposure.
# Configuration example: restrict gossip port with iptables (adjust port and CIDR)
sudo iptables -A INPUT -p tcp --dport 7946 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 7946 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 7946 -j DROP
sudo iptables -A INPUT -p udp --dport 7946 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
