CVE-2026-14362 is a denial-of-service vulnerability in the HashiCorp memberlist library's push/pull state handling mechanism. An attacker with network access to the gossip port (UDP/TCP, typically 7946 or 9094) can cause memory exhaustion on a node running the gossip listener, resulting in process termination. Red Hat Advanced Cluster Management for Kubernetes ships the acm-grafana component with unified alerting disabled by default, so it does not start the vulnerable gossip listener and is not affected. However, Red Hat Multicluster Global Hub enables unified alerting and the gossip listener by default, making it vulnerable. The vulnerability is addressed by upgrading memberlist to version 0.6.0 or later. As a temporary mitigation, network access to the gossip port should be restricted to trusted cluster members only.

The vulnerability allows an unauthenticated attacker with network access to the gossip port to cause memory exhaustion on affected nodes, leading to denial of service by process termination. There is no impact on confidentiality or integrity, only availability is affected. Red Hat Advanced Cluster Management for Kubernetes itself is not affected due to default configuration, but related products that enable the gossip listener are vulnerable. No known exploits are reported in the wild at this time.

A fix is available by upgrading the github.com/hashicorp/memberlist component to version 0.6.0 or later, which resolves the push/pull state handling issue. Until the fix is applied, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only using network policies, firewall rules, or security groups. Red Hat Advanced Cluster Management for Kubernetes does not enable the vulnerable gossip listener by default and is not affected, so no action is required for default deployments of this product.