CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist
An attacker with network access can cause a denial of service by exhausting memory via crafted gossip messages in the memberlist library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14362?
CVE-2026-14362 is a medium-severity denial of service vulnerability in HashiCorp Shared library, published on 8 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-14362?
How do I fix CVE-2026-14362?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-14362 being exploited?
There is no known exploitation of CVE-2026-14362 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-NY71627, CLEANSTART-2026-WV25742, GHSA-6r3r-6rpf-v429.