CVE-2026-14362— Denial of service via crafted push/pull gossip message in memberlist
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HashiCorp | Shared library | 0.1.5< 0.6.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-14362
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial of service via crafted push/pull gossip message in memberlist
Source: NVD (National Vulnerability Database)
Vulnerability Description
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Shared library | 0.1.5 ~ 0.6.0 | - |
II. Public POCs for CVE-2026-14362
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14362
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14362 (1)
Same Patch Batch · HashiCorp · 2026-07-08 · 5 CVEs total
| CVE-2026-14891 | 8.7 HIGH | Nomad vulnerable to sandbox escape in Docker task driver |
| CVE-2026-14373 | 7.7 HIGH | Nomad Docker driver Linux host namespace bypass |
| CVE-2026-14361 | 4.7 MEDIUM | Consul-template is vulnerable to path redirection in writeToFile through symlink attack |
| CVE-2026-14896 | 4.2 MEDIUM | Nomad vulnerable to cross-namespace host volume claim deletion |
IV. Related Vulnerabilities
Same product: Shared library
- CVE-2026-8052
Nomad's exec2 task driver vulnerable to arbitrary file read/ - CVE-2026-0969
Arbitrary code execution in React server-side rendering of u - CVE-2025-8959
HashiCorp go-getter Vulnerable to Arbitrary Read through Sym - CVE-2025-0377
HashiCorp go-slug Vulnerable to Zip Slip Attack - CVE-2024-6257
HashiCorp go-getter Vulnerable to Code Execution On Git Upda
Same vendor: HashiCorp
- CVE-2026-14896
Nomad vulnerable to cross-namespace host volume claim deleti - CVE-2026-14361
Consul-template is vulnerable to path redirection in writeTo - CVE-2026-14891
Nomad vulnerable to sandbox escape in Docker task driver - CVE-2026-14373
Nomad Docker driver Linux host namespace bypass - CVE-2026-14468
Path traversal allows arbitrary file read in Terraform Enter
Same weakness: CWE-770
- CVE-2026-57220
RabbitMQ: Stream listener does not enforce configured frame- - CVE-2026-57212
RabbitMQ management HTTP API accepts request bodies larger t - CVE-2026-53653
Grav: Unauthenticated denial of service via unbounded image - CVE-2026-54063
Excelize: Unbounded Row Index Allocation in Worksheet Parser - CVE-2026-58661
n8n - Disk Space Exhaustion via Data-Table File Upload Endpo
V. Comments for CVE-2026-14362
No comments yet