VDB
RHSA-2026:54602
RHSA-2026:54602
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in HashiCorp memberlist. An attacker with network access to the gossip port could exploit a vulnerability in the push/pull state handling. This could lead to memory exhaustion on a receiving node, causing the process to terminate. This flaw results in a Denial of Service (DoS).
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-thanos-rhel9@sha256:76f21e3e8ad35d216b791722f08d93af3a03dca7dc3cfd96a69ae7e2cc70fe12_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hyperkube-rhel9@sha256:76fe712728bd92a5c6d0dd715a9eaa380de985dd6a1929d08283e533075c6b68_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-apiserver-rhel9@sha256:51fc017df5de68a5a37f7f62a11195c505b35e5535422536e0c1e3bdd1c4a826_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9@sha256:0a51a4bed3453626f860df9ee5c947a06261352bddc36408595ed0fab9661ba2_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:8806c2b9b442a748343e435b7e610b669b3519505841b6cb9396ece016325c3c_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-operator-admission-webhook-rhel9@sha256:d7ee1e3347443359e43154958b51afa8b2d0e2b2fdb732d5378c7764740fab85_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-route-override-cni-rhel9@sha256:28bf1944cd759d3577b3f85267e00e0476fe6942b03f629eb764e5249b774af6_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel9@sha256:7965b88b167325480fb109bbc5b5f1f4e75a4422a2e6f351b26ee08b7295187a_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:3049ca128a9e29b0d73deea8a9293971c657daa878b70cb409eaaccdb406fe3a_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-csi-driver-syncer-rhel9@sha256:ef26196487ea00c21ea2db76823c84f3130652ca34ab8d9d690ecef1fd61b047_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-haproxy-router-rhel9@sha256:c058ccdbd13cf54e33eb1e0c24347174c42efcdf7cdf9d9c0633388b23855a6f_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-update-keys-rhel9@sha256:ea0508280f089272a0ae354e6150a646292ff85c0c27c27c2e95c078718986c3_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prom-label-proxy-rhel9@sha256:7cf1b72edc476123ccf497fa5c943c9ace680e5c3bd36db31e13dfebe4fda935_amd64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-rhel9-operator@sha256:bd8db0b9e52c9ce6452cfb3c9e8ac41b845a53bf4a09b5ca647ee579969ebd76_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openshift-controller-manager-rhel9@sha256:a7929ad32196f545a85b30f28f15e7dddeff6c8e51a2395bfc5dab30b07526d8_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:0eb86ecf0e14916013d8234b6bb940cab3a1aea19ff79b6272c43ba61b796bcb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9@sha256:df4b604483865900ce833eb997cb839d30c8098a8f4f82158831a937fc247d59_s390x as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-rhel9@sha256:62f865b59637a95f177871450e31d6ae0d4ecdf9a84e174331e7bfdc760b7237_ppc64le as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-rhel9-operator@sha256:98190f4573a41b6a6628afb505330e199cc0e35b331bc87c1a9375c3756b352d_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
| Red Hat | registry.redhat.io/openshift4/ose-network-metrics-daemon-rhel9@sha256:03b8647f0f0a6a6d2ff9bf20a8a742d69ff49e00728453640b0b9238cbce7c04_arm64 as a component of Red Hat OpenShift Container Platform 4.21 | * |
…and 634 more
Timeline
- Aug 18, 2026 CVE Published
- Sep 24, 2026 CVE Updated
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54602 advisory
- https://access.redhat.com/security/cve/CVE-2026-14362 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-42965 advisory
- https://access.redhat.com/security/cve/CVE-2026-44918 advisory
- https://access.redhat.com/security/cve/CVE-2026-46597 advisory
- https://access.redhat.com/security/cve/CVE-2026-50236 advisory
- https://access.redhat.com/security/cve/CVE-2026-50237 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54602.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498174 issue
- https://www.cve.org/CVERecord?id=CVE-2026-14362 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-14362 advisory
- https://discuss.hashicorp.com/t/hcsec-2026-18-memberlist-vulnerable-to-denial-of-service-via-gossip-message/77556 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2467822 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33811 advisory
…and 51 more