CVE-2026-14362: HashiCorp Memberlist Denial of Service Vulnerability

Technical summary

CVE-2026-14362 is a memory exhaustion vulnerability in the push/pull state synchronization mechanism of HashiCorp memberlist prior to 0.6.0. The gossip protocol implementation fails to properly limit memory consumption when processing state updates, allowing a network-adjacent attacker to craft messages that trigger unbounded allocation on a receiving node. This results in out-of-memory conditions and process termination (denial of service). The issue is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS 3.1 score of 4.9 (Medium).

Business impact

Organizations deploying memberlist for cluster coordination—such as HashiCorp Consul, Nomad, or Vault deployments, or custom applications using memberlist—face potential service availability loss if a node is targeted. While the CVSS score is moderate and privileges are required, the practical impact is cluster instability: a single crashed node forces failover, potentially cascading if multiple nodes are targeted. For mission-critical infrastructure relying on these systems, even temporary unavailability can disrupt service orchestration, configuration management, or secrets distribution.

Affected systems

HashiCorp memberlist versions prior to 0.6.0 are vulnerable. This affects any deployment of HashiCorp Consul, Nomad, or Vault that bundles a vulnerable memberlist version, as well as third-party applications that directly depend on memberlist for cluster or peer-to-peer communication. Administrators should verify their current version against the memberlist release notes and check the vendor advisories for their specific HashiCorp products to determine applicability.

Exploitability

Exploitation requires network access to the gossip port (typically UDP port 8301 for Consul and similar ports for other services). The attack vector is network-based but with high privilege assumptions baked into the CVSS vector, suggesting the attacker must either be within a trusted network segment or possess elevated access context. Public exploit code is not known to be available. Successful exploitation is deterministic once an attacker can send crafted gossip messages, making this a practical concern in environments where the gossip port is exposed or accessible from less-trusted network segments.

Remediation

Upgrade HashiCorp memberlist to version 0.6.0 or later. For users of Consul, Nomad, or Vault, this typically involves upgrading the parent product to a release that bundles the patched memberlist version. Verify the specific version numbers in the respective vendor advisories. As an interim measure, restrict network access to the gossip port via firewall rules to trusted cluster members only.

Patch guidance

1. Identify all deployments using memberlist or HashiCorp products that bundle it (Consul, Nomad, Vault). 2. Consult the official HashiCorp release notes and advisories to confirm which product versions include memberlist 0.6.0 or later. 3. Schedule and test the upgrade in a non-production environment first to verify cluster stability and compatibility. 4. During the upgrade, plan for rolling restarts to maintain availability. 5. Verify the patched version is active via version command or API endpoints after deployment.

Detection guidance

Monitor for sudden out-of-memory conditions or unexpected process terminations on nodes running memberlist-dependent services. Network-based detection is challenging without deep packet inspection of gossip traffic; focus on behavioral indicators: rapid memory growth on specific nodes concurrent with gossip activity, or repeated node crashes in a cluster. Implement alerts on process restart frequency and memory usage anomalies. Log analysis of gossip errors or state synchronization failures may also surface exploitation attempts, though false positives from legitimate network issues are likely.

Why prioritize this

This is a Medium-severity DoS vulnerability affecting cluster infrastructure. While it requires network access and does not compromise confidentiality or integrity, the practical impact on service availability and the ease of targeted exploitation once access is gained warrant timely patching. Organizations running Consul, Nomad, or Vault in production should prioritize this within their standard patch cycle (e.g., next monthly maintenance window). The fact it is not yet in the CISA Known Exploited Vulnerabilities catalog suggests limited active exploitation to date, but the attack surface is non-zero for exposed gossip ports.

Risk score, explained

CVSS 3.1 score of 4.9 reflects a network attack vector, low attack complexity, high privilege assumption, no user interaction required, and high availability impact (process crash) but no confidentiality or integrity impact. The 'high privilege' factor reflects the assumption that the attacker must be on or near the network path to the gossip port, which in a typical datacenter or cloud environment may be a reasonable constraint but could be trivial if the port is internet-facing or in a flat network. Organizations with tightly segmented networks may assess this lower; those with broader access may rate it higher.

Frequently asked questions