Executive brief
HashiCorp memberlist is a software library used by products like Consul and Nomad to manage communication between servers in a cluster. A flaw in how it handles synchronization messages allows an attacker to crash the service by forcing it to consume all available memory. This can lead to a total service outage, preventing the cluster from functioning correctly.
Technical details
A denial-of-service vulnerability exists in HashiCorp memberlist due to improper validation of message headers during push/pull state synchronization. The library pre-allocates memory based on the node count and user state length declared in a message header before reading the actual message body. An attacker with network access to the gossip port can send a crafted message with large declared values, triggering an out-of-memory (OOM) condition and process termination. While unauthenticated by default, clusters with gossip encryption enabled require the shared key for exploitation. The issue is fixed in memberlist version 0.6.0, Consul 2.0.2, and Nomad 2.0.4.
Affected products
- HashiCorp memberlist < 0.6.0
- HashiCorp Consul < 2.0.2
- HashiCorp Nomad < 2.0.4
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched