CVE-2026-14362

A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).

Only Red Hat products that run the affected component as a live memberlist gossip agent (a process that binds and listens on a UDP/TCP gossip port for cluster membership) are exposed to this denial-of-service issue. Products that pull in github.com/hashicorp/memberlist only as a transitive Go dependency, without starting a gossip listener, do not exercise the vulnerable push/pull state-handling code path and are not affected.

Grafana links github.com/hashicorp/memberlist solely for its optional unified-alerting high-availability (HA) clustering feature; the gossip listener only starts when unified_alerting.ha_peers (plus ha_listen_address/ha_advertise_address) is explicitly configured. Red Hat Advanced Cluster Management for Kubernetes ships its acm-grafana component with unified alerting disabled by default (unified_alerting.enabled = false) and never sets ha_peers, so it never starts the gossip listener and does not exercise the vulnerable code path; it is not affected. Red Hat Multicluster Global Hub ships its multicluster-globalhub-grafana component with unified alerting enabled and ha_peers configured by default, so it does start the gossip listener regardless of replica count and remains affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade github.com/hashicorp/memberlist to version 0.6.0 or later, which fixes the push/pull state handling issue. As a temporary mitigation, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only, e.g. via network policy, firewall rules, or security groups, since the flaw requires network access to the gossip listener to trigger memory exhaustion.