Every CVESearch/Get API key

CVE-2026-14362

Denial of service via crafted push/pull gossip message in memberlist

4.9 Medium

CVE-2026-14362 is a medium vulnerability (CVSS 4.9) in Hashicorp Shared Library, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. No source names a fixed version.

What does this mean?
Severity
4.9 MediumCVSS 3.1, CVE List
Exploit chance
0.25%EPSS, 16th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.25%Unchanged since Jul 9, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
before 1.20.1-150700.15.34.1
1.20.1-150700.15.34.1
alloy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
before 1.20.1-1.1
1.20.1-1.1

What each source reports

CVE List Score used4.9

Denial of service via crafted push/pull gossip message in memberlist

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Record
CVE-2026-14362
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2026-423424.9

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Record
EUVD-2026-42342
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6r3r-6rpf-v4294.9

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push...

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Record
GHSA-6r3r-6rpf-v429
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
NVD4.9

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Record
CVE-2026-14362
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSV4.9

Denial of service via crafted push/pull gossip message in memberlist

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Record
CVE-2026-14362
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-12
OSVopenSUSE-SU-2026:12114-1No score

alloy-1.20.1-1.1 on GA media

These are all security issues fixed in the alloy-1.20.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12114-1
Updated
2026-11-02
OSVSUSE-SU-2026:5203-1No score

Security update for alloy

This update for alloy fixes the following issues:

Security issues fixed:

  • CVE-2026-14362: HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue (bsc#1271206).
  • CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283592).
  • CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281472).
  • CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281473).
  • CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279331).
  • CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279232).
  • CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing :authority and Host headers in gRPC-Go xDS servers (bsc#1279394).

Non security issue fixed:

  • alloy 1.20.1: alloy.service references missing /usr/lib/alloy/alloy-wrapper (203/EXEC) (bsc#1285585).

Changes for alloy:

  • Increase required memory in constraints
  • Update to version 1.20.1:
  • Bug fixes: loki: Add the timestamp to batch size calculation loki: Include estimate for stream labels in batch size loki: Make byte counters count uncompressed bytes otelcol.connector.host_info: Fix potential over-count otelcol.receiver.cloudflare: Default max_request_body_size to 20MiB prometheus.remote_write: Tolerate unknown WAL record types
  • Update to version 1.20.0:
  • BREAKING CHANGE: discovery.hetzner: no longer exports the __meta_hetzner_datacenter label for targets with role = 'hcloud'
  • BREAKING CHANGE: otelcol.receiver.filelog: top_n now distinguishes an explicit 0 from leaving it unset
  • Features: loki.source.podlogs: Add use_apiserver_cache to reduce API server load loki.write: Add max_streams to limit active streams pyroscope.scrape: Support scraping custom pprof profiles
  • Enhancements: discovery.kubernetes: Add support for EndpointSlice filtering by service loki.process: stage.geoip now supports GeoLite2 City database discovery.file: Fix targets not updating on content change prometheus.relabel: Fix metrics getting stuck in NaN state
Record
SUSE-SU-2026:5203-1
Updated
2026-11-12

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 15 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open