{"id":"CVE-2026-14362","aliases":["EUVD-2026-42342","GHSA-6r3r-6rpf-v429","SUSE-SU-2026:5203-1","openSUSE-SU-2026:12114-1"],"status":"published","title":"Denial of service via crafted push/pull gossip message in memberlist","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00251,"percentile":0.16748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-07-08T17:14:18Z","modified":"2026-11-12T12:27:19Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-150700.15.34.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"alloy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-1.1"}]}],"bundled":7}],"products":[{"vendor":"hashicorp","product":"shared library"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14362","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6r3r-6rpf-v429"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14362.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/memberlist","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265203-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271206","tags":["report"]},{"url":"https://bugzilla.suse.com/1279232","tags":["report"]},{"url":"https://bugzilla.suse.com/1279331","tags":["report"]},{"url":"https://bugzilla.suse.com/1279394","tags":["report"]},{"url":"https://bugzilla.suse.com/1281472","tags":["report"]},{"url":"https://bugzilla.suse.com/1281473","tags":["report"]},{"url":"https://bugzilla.suse.com/1283592","tags":["report"]},{"url":"https://bugzilla.suse.com/1285585","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-81872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-14362","title":"Denial of service via crafted push/pull gossip message in memberlist","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","status":"published","published":"2026-07-08T17:14:18.218Z","modified":"2026-07-08T19:40:16.119Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-42342","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","status":"published","published":"2026-07-08T17:14:18Z","modified":"2026-07-08T19:40:16Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:10.095263Z"}],"ghsa":[{"id":"GHSA-6r3r-6rpf-v429","title":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push...","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","status":"published","published":"2026-07-08T18:31:38Z","modified":"2026-07-08T18:31:43Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:09:20.268554Z"}],"nvd":[{"id":"CVE-2026-14362","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","status":"published","published":"2026-07-08T18:16:32.13Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-14362","title":"Denial of service via crafted push/pull gossip message in memberlist","description":"HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.","status":"published","published":"2026-07-08T17:14:18.218Z","modified":"2026-11-12T12:27:19.548481488Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-12T12:48:34.460153Z"},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","description":"These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:09.124869157Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:5203-1","title":"Security update for alloy","description":"This update for alloy fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-14362: HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue (bsc#1271206).\n- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass\n  repeat index validation and cause a process crash (bsc#1283592).\n- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass\n  allows log telemetry interception and alteration (bsc#1281472).\n- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission\n  (bsc#1281473).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279331).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279232).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in gRPC-Go xDS\n  servers (bsc#1279394).\n\nNon security issue fixed:\n\n- alloy 1.20.1: alloy.service references missing /usr/lib/alloy/alloy-wrapper (203/EXEC) (bsc#1285585).\n\nChanges for alloy:\n\n- Increase required memory in constraints\n- Update to version 1.20.1:\n * Bug fixes:\n loki: Add the timestamp to batch size calculation\n loki: Include estimate for stream labels in batch size\n loki: Make byte counters count uncompressed bytes\n otelcol.connector.host_info: Fix potential over-count\n otelcol.receiver.cloudflare: Default max_request_body_size\n to 20MiB\n prometheus.remote_write: Tolerate unknown WAL record types\n- Update to version 1.20.0:\n * BREAKING CHANGE: discovery.hetzner: no longer exports the\n __meta_hetzner_datacenter label for targets with role =\n 'hcloud'\n * BREAKING CHANGE: otelcol.receiver.filelog: top_n now\n distinguishes an explicit 0 from leaving it unset\n * Features:\n loki.source.podlogs: Add use_apiserver_cache to reduce API\n server load\n loki.write: Add max_streams to limit active streams\n pyroscope.scrape: Support scraping custom pprof profiles\n * Enhancements:\n discovery.kubernetes: Add support for EndpointSlice\n filtering by service\n loki.process: stage.geoip now supports GeoLite2 City database\n discovery.file: Fix targets not updating on content change\n prometheus.relabel: Fix metrics getting stuck in NaN state\n","status":"published","published":"2026-11-11T12:52:32Z","modified":"2026-11-12T12:15:06.01497596Z","updated_at":"2026-11-12T12:48:34.460153Z"}]}}