# CVE-2026-14362: HashiCorp memberlist denial of service in push/pull state handling

Source: https://junglewise.ai/threats/cve-2026-14362-hashicorp-memberlist-denial-of-service-in-push-pull-state  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-14362 · Severity: medium · CVSS 4.9 · Published 2026-07-08

HashiCorp memberlist is a software library used by products like Consul and Nomad to manage communication between servers in a cluster. A flaw in how it handles synchronization messages allows an attacker to crash the service by forcing it to consume all available memory. This can lead to a total service outage, preventing the cluster from functioning correctly.

Technologies: [HashiCorp Consul](https://junglewise.ai/threats/technologies/consul), [HashiCorp Nomad](https://junglewise.ai/threats/technologies/nomad). Vendors: [HashiCorp](https://junglewise.ai/threats/vendors/hashicorp).

## Quick answers

**Is CVE-2026-14362 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14362 being exploited in the wild.

**How severe is CVE-2026-14362?** Medium severity, with a CVSS score of 4.9, published 8 July 2026.

**Which products and versions are affected?** HashiCorp Consul < 2.0.2; HashiCorp Memberlist < 0.6.0; HashiCorp Nomad < 2.0.4.

**Is there a fix for CVE-2026-14362?** A patch was published on 2026-07-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14362 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14362?** Check whether you run HashiCorp Consul, HashiCorp Memberlist or HashiCorp Nomad at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in HashiCorp memberlist due to improper validation of message headers during push/pull state synchronization. The library pre-allocates memory based on the node count and user state length declared in a message header before reading the actual message body. An attacker with network access to the gossip port can send a crafted message with large declared values, triggering an out-of-memory (OOM) condition and process termination. While unauthenticated by default, clusters with gossip encryption enabled require the shared key for exploitation. The issue is fixed in memberlist version 0.6.0, Consul 2.0.2, and Nomad 2.0.4.

## Affected products

- HashiCorp memberlist < 0.6.0
- HashiCorp Consul < 2.0.2
- HashiCorp Nomad < 2.0.4

## Timeline

- 2026-07-08: disclosed
- 2026-07-08: advisory
- 2026-07-08: patched

## References

- [https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556](https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556)

## Related threats

- [HashiCorp Nomad symlink following in allocation data migration](https://junglewise.ai/threats/cve-2026-119168-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad symlink following in dispatch payload and executor logs](https://junglewise.ai/threats/cve-2026-107347-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-symlink)
- [HashiCorp Nomad cross-namespace authorization bypass in API endpoints](https://junglewise.ai/threats/cve-2026-102260-hashicorp-nomad-and-nomad-enterprise-are-vulnerable-to-cross)
- [HashiCorp Consul authorization bypass in health check registration](https://junglewise.ai/threats/cve-2026-115804-hashicorp-consul-and-consul-enterprise-are-vulnerable-to-an)
- [HashiCorp Consul authorization bypass in service mesh leaf certificate API](https://junglewise.ai/threats/cve-2026-105765-hashicorp-consul-and-consul-enterprise-1-17-0-up-to-2-0-4-are)