CVE-2026-14362 is a denial-of-service vulnerability in HashiCorp memberlist, a shared library used for cluster membership and gossip communication. The issue arises from allocation of resources without limits or throttling (CWE-770) in the push/pull state handling, allowing an attacker with network access to the gossip port to exhaust memory on the target node, leading to process termination. The vulnerability affects all memberlist versions from 0.1.5 up to but not including 0.6.0. The vulnerability has a CVSS v3.1 score of 4.9 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. No official remediation level or patch link is provided in the data, but the issue is fixed in memberlist version 0.6.0.

Successful exploitation results in denial of service by exhausting memory on the receiving node, causing the memberlist process to terminate. There is no impact on confidentiality or integrity, but availability is affected. The attacker must have network access to the gossip port and high privileges to exploit this vulnerability.

Upgrade HashiCorp memberlist to version 0.6.0 or later, where this vulnerability is fixed. Since no official patch or temporary fix is provided in the advisory, updating to the fixed version is the recommended remediation. Monitor vendor advisories for any additional guidance.