Read the docs
TI-2026-12143 Aliases CVE-2026-14362GHSA-6r3r-6rpf-v429

Denial of service via crafted push/pull gossip message in memberlist

Priority LOW 22CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix Partial Shared library (HashiCorp): 0.6.0Red Hat: 14 advisoriesRed Hat: 14 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HashiCorpShared library0.1.5 to before 0.6.00.6.0Patch availableCNA
  • Shared library VendorHashiCorp Affected 0.1.5 to before 0.6.0 Fixed in 0.6.0 Patch available CNA

Remediation

  • Fix · CNA Shared library (HashiCorp) Fixed in 0.6.0

Red Hat 14 advisories

  • RHSA-2026:89839 Released 2026-10-27 · Red Hat rating Important
    OpenShift Container Platform 4.14.77 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:89715 Released 2026-10-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.74 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:70587 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
Show 11 more Red Hat advisories
  • RHSA-2026:65852 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.18.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:57408 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.19.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9 +9
  • RHSA-2026:57545 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.20.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:54770 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.22.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator +11
  • RHSA-2026:54602 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.21.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +6
  • RHSA-2026:54427 Released 2026-08-12 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:54427
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:89839
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:89715
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:70587
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:65852
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:57408
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:57545
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:54602
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:54770
Not affected: 25 products
  • Logging Subsystem for Red Hat OpenShift
  • Multicluster Global Hub
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift GitOps
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14362
  2. 2026-10-03 Alias added: GHSA-6r3r-6rpf-v429
  3. 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.16 · Red Hat
  4. 2026-10-30 Fix available: RHSA-2026:89839 · Red Hat
  5. 2026-10-30 Fix available: RHSA-2026:89715 · Red Hat
  6. 2026-10-30 Affected versions changed · Red Hat

References

Other 1

  • TI-2024-01904 Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates CVSS 3.1CRITICAL 9.8
  • TI-2021-18437 HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4… CVSS 3.1HIGH 8.8
  • TI-2026-06570 Nomad vulnerable to path traversal in dynamic host volume which may lead to code execution CVSS 3.1HIGH 8.8
  • TI-2020-17753 The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root… CVSS 3.1CRITICAL 9.8
  • TI-2026-13641 consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
  • TI-2026-13778 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode CVSS 3.1CRITICAL 10.0
See all 246 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences