CVE-2026-14362: 
Docker vulnerability analysis and mitigation

CVE-2026-14362 is a denial-of-service vulnerability in HashiCorp memberlist, a Go library implementing gossip-based cluster membership and failure detection. The flaw exists in the library's push/pull state handling mechanism, allowing an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. Affected versions span from 0.1.5 up to (but not including) 0.6.0; the issue is fixed in memberlist 0.6.0. It carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory, Red Hat Bugzilla). The vulnerability was published on July 8, 2026, and assigned GHSA-6r3r-6rpf-v429 (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the memberlist library does not impose adequate restrictions on the size or number of resources allocated when processing push/pull state messages received on the gossip port (GitHub Advisory). An attacker with network-level access to the gossip port can send specially crafted push/pull packets that cause the receiving node to allocate unbounded memory, ultimately exhausting available memory and terminating the memberlist process. Exploitation requires high privileges per the CVSS scoring (PR:H), suggesting the attacker must have some level of network access or authentication to reach the gossip port, though the exact authentication requirement is not fully detailed in public disclosures (HashiCorp Advisory). No public proof-of-concept code has been identified.

Successful exploitation results in memory exhaustion on the targeted node, causing the memberlist process to crash and rendering the affected node unavailable within the cluster. This impacts availability (High) with no effect on confidentiality or integrity, as the attack is purely a denial-of-service condition (GitHub Advisory). In distributed systems relying on memberlist for cluster membership (such as HashiCorp Consul, Nomad, or Serf), crashing the memberlist process on one or more nodes could disrupt cluster coordination, cause service degradation, or trigger cascading failures across dependent services (Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (HashiCorp Advisory). The NVD SSVC assessment confirms exploitation status as "none" and the attack is not automatable (GitHub Advisory). The EPSS score is approximately 0.251%, placing it in the 17th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

The primary remediation is to upgrade HashiCorp memberlist to version 0.6.0 or later, which contains the fix for this vulnerability (GitHub Advisory, HashiCorp Advisory). As a workaround, restrict network access to the gossip port (typically TCP/UDP 7946 for memberlist-based tools) to only trusted cluster nodes using firewall rules or network segmentation. Implementing network-level controls to prevent unauthorized systems from reaching the gossip port reduces the attack surface until patching is feasible.

HashiCorp published an official security advisory (HCSEC-2026-18) disclosing the vulnerability and confirming the fix in memberlist 0.6.0 (HashiCorp Advisory). Red Hat opened a tracking bug (BZ#2498174) with high severity and high priority, indicating downstream impact assessment is underway for Red Hat products that bundle memberlist (Red Hat Bugzilla). No notable independent researcher commentary or significant social media discussion has been identified at this time.