HCSEC-2026-18: HashiCorp memberlist DoS via Gossip Messages (CVE-2026-14362)

Vulnerability Overview HCSEC-2026-18 - Memberlist Vulnerable to Denial of Service via Gossip Messages Vulnerability Description: HashiCorp memberlist versions prior to 0.6.0 contain a denial-of-service vulnerability in its push/pull state handling. An attacker with network access to the gossip port can exhaust the memory of the receiving node, causing the process to terminate. CVE ID: CVE-2026-14362 Publication Date: July 8, 2026 Affected Scope Affected Products/Versions: memberlist versions 0.5.4 and below; fixed in version 0.6.0. Background: HashiCorp memberlist is a Go library used for managing cluster membership and failure detection. It uses a gossip-based protocol and is embedded in HashiCorp products such as Consul and Nomad. As part of state synchronization, nodes periodically exchange full membership and user state over TCP, where message headers declare the number of nodes and the size of the user state. Remediation Remediation Steps: Customers should assess the risk associated with this issue and consider upgrading to memberlist 0.6.0, Consul 2.0.2, or Nomad 2.0.4. Customers unable to upgrade immediately can mitigate unauthenticated exploitation by enabling gossip encryption. Detailed Information: When a node receives a push/pull state message, memberlist pre-allocates memory based on the node count and user state length declared in the message header, before reading the rest of the message. It does not verify that these values match the actual message size or any defined upper limits. An attacker with network access can send a small, carefully crafted message to the gossip port, where the message header declares very large values. This causes the receiver to attempt to allocate excessive memory, resulting in termination and a denial of service. In clustered deployments, repeated requests can render the affected node unavailable. If gossip encryption is not enabled, this attack vector does not require authentication, which is the default configuration; clusters with gossip encryption enabled require a shared key for communication on the gossip port and are only exposed to authenticated exploitation. Acknowledgments Reporter: This issue was reported to HashiCorp by Andy Gill of ZephSec. Related Topics Memberlist Documentation? Does Consul use both serf and memberlist? Can someone review the memberlist PR? HCSEC-2025-29 - Consul KV Endpoint Vulnerable to Denial of Service HCSEC-2023-15 - Consul Cluster Peering Can Lead to Denial of Service Summary This vulnerability allows an attacker to cause a denial of service by sending crafted gossip messages that lead to memory exhaustion and process termination in memberlist nodes. Users are advised to upgrade to the patched version or enable gossip encryption to mitigate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

HCSEC-2026-18: HashiCorp memberlist DoS via Gossip Messages (CVE-2026-14362)