Description
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Shared library | 0.1.5 – < 0.6.0 | 0.6.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.20.1-150700.15.34.1 | SUSE-SU-2026:5203-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.20.1-1.1 | openSUSE-SU-2026:12114-1 |
Advisories 2
- SUSE-SU-2026:5203-1 Security update for alloy SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:12114-1 alloy-1.20.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026