VDB
RHSA-2026:54427
RHSA-2026:54427
PUBLISHED
CVSS 8 HIGH
A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).
Risk Scores
CVSS 3.1
8
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/metrics-collector-rhel9@sha256:41311a9a395fea38f67fa954de4ceca786820a2c27bba59369da5fcdec56e514_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:ea647473a29becdead38ce07c20a3836dce6b9c4355b8ec749fa6c8fa01656ff_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:76c04f4014f8b72600be2927ab294ef92528cc5ca68b75f0c3fe476b320e5e9d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9@sha256:23e9500e2b88f703d92c0e71008bdb96c442835fe0caa5960c60f74e4d083a3a_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9@sha256:3e996a288bdb941a3b266ef64c594eef1899091681de69f307c04f73e3333820_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/kube-rbac-proxy-rhel9@sha256:9aaf56ab79342abcca348ca4452c6c17ec86ec5838fb0baf9a27a2bc4f7c67d7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:30205c1c53b731e727f4015af5c63e2928db2ee86b846f883271743ea51867d9_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/kube-state-metrics-rhel9@sha256:328c1fb3983fd19e3b8794ef340f2f1c38e3b4869aabd42c929c37686ba142f7_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:2a43a8e435a9d83b9003f2a4c8660385ba95ac9eee0513cfc32db3a78f6cd710_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-application-rhel9@sha256:012ed2651cabbe498a525c90063d78fe468a94ca607bf4e027bc8179aca6eb60_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:1399e8f547435a00446d2254ac70f41eb6537edf220287777dc484aaceaedc6d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:0feb2bb59207a0c9acdfca1f0b279ea37030eb17329ada7c2873d219946165c4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:5d22f6fb1baaa09c4c35516106da5d628ea8ce468441aefebb9ffb10a141ebfa_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/thanos-receive-controller-rhel9@sha256:1e4a7ea7f4de810de638affd4ca9d2671c47137d9b916cd3d9bf2982abead18c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:0162d426242039dbb8d81bbeae6649cf21cd000c68531a54260cde322a487de4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:b23c5b7eea0c3cf26ad1ad2dffda8847f8ab32f614ba5612b98755ef48345941_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/kube-rbac-proxy-rhel9@sha256:bce92caf55f2567aae42a86923253afb01671c204245ad86c2beaff8430a6639_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-rhel9@sha256:9fec429e172e0b73c04ffd73cf4c20205aa8beaf232ece79693deea008d9b4b3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:081e80d92fb4abca986fe555fecb5a1089c2ed884a8b06c673c2d9a0cba28a7d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:63012f693b6046ca95edfc8f63e999d7da0c05f0d6bb9b614fba426f968ec85f_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.15 | * |
…and 164 more
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54427 advisory
- https://access.redhat.com/security/cve/CVE-2026-14362 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27145 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/cve/CVE-2026-44740 advisory
- https://access.redhat.com/security/cve/CVE-2026-45623 advisory
- https://access.redhat.com/security/cve/CVE-2026-66805 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54427.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498174 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14362 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14362 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
…and 38 more