Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T17:14:18 github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).

Only Red Hat products that run the affected component as a live memberlist gossip agent (a process that binds and listens on a UDP/TCP gossip port for cluster membership) are exposed to this denial-of-service issue. Products that pull in github.com/hashicorp/memberlist only as a transitive Go dependency, without starting a gossip listener, do not exercise the vulnerable push/pull state-handling code path and are not affected. Grafana links github.com/hashicorp/memberlist solely for its optional unified-alerting high-availability (HA) clustering feature; the gossip listener only starts when unified_alerting.ha_peers (plus ha_listen_address/ha_advertise_address) is explicitly configured. Red Hat Advanced Cluster Management for Kubernetes ships its acm-grafana component with unified alerting disabled by default (unified_alerting.enabled = false) and never sets ha_peers, so it never starts the gossip listener and does not exercise the vulnerable code path; it is not affected. Red Hat Multicluster Global Hub ships its multicluster-globalhub-grafana component with unified alerting enabled and ha_peers configured by default, so it does start the gossip listener regardless of replica count and remains affected. Upgrade github.com/hashicorp/memberlist to version 0.6.0 or later, which fixes the push/pull state handling issue. As a temporary mitigation, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only, e.g. via network policy, firewall rules, or security groups, since the flaw requires network access to the gossip listener to trigger memory exhaustion. Logging Subsystem for Red Hat OpenShift Not affected openshift-logging/loki-rhel9-operator Multicluster Global Hub Not affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/prometheus-alertmanager-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform/platform-operator-bundle Red Hat Ceph Storage 5 Fix deferred rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 5 Fix deferred rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 6 Fix deferred rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 6 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 8 Fix deferred rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 9 Fix deferred rhceph/alloy-rhel10 Red Hat Ceph Storage 9 Fix deferred rhceph/grafana-rhel10 Red Hat Ceph Storage 9 Fix deferred rhceph/snmp-notifier-rhel10 Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected rhel10/grafana Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 9 Not affected grafana Red Hat Enterprise Linux 9 Not affected rhel9/grafana Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel8 Red Hat OpenShift Container Platform 4 Affected openshift4/metallb-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/oc-mirror-plugin-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-prometheus-alertmanager Red Hat OpenShift Container Platform 4 Affected openshift4/ose-prometheus-alertmanager-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-thanos-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel8 Red Hat OpenShift GitOps Not affected openshift-gitops-1/argocd-rhel9 Red Hat OpenStack Platform 18.0 Not affected rhoso-operators/openstack-operator-bundle https://www.cve.org/CVERecord?id=CVE-2026-14362 https://nvd.nist.gov/vuln/detail/CVE-2026-14362 https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556