Most recent entries from all

BELL-CVE-2026-73500

Affected: Alpaquita:25: etcd, Alpaquita:stream: etcd

BIT-etcd-2026-73500 — etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Affected: Bitnami: etcd

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

CLEANSTART-2026-AZ15466 — etcd is a distributed key-value store for the data of a distributed system

Affected: CleanStart: cortex

Security vulnerability affects the cortex package. etcd is a distributed key-value store for the data of a distributed system.

EUVD-2026-352268

fkie_cve-2026-73500

GHSA-6vch-q96h-7gc3 — etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Affected: Go: go.etcd.io/etcd/v3

### Impact _What kind of vulnerability is it? Who is impacted?_

A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).

### Patches _Has the problem been patched? What versions should users upgrade to?_

This vulnerability is patched in the following versions:

- etcd 3.7.1 - etcd 3.6.14 - etcd 3.5.33

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading is not immediately possible, then restrict network access. Limit which hosts can reach etcd's client (gRPC) port via firewall rules or network policy, reducing who can attempt exploitation.

### Reporter

VMware By Broadcom

msrc_CVE-2026-73500 — etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

msrc_CVE-2026-73500

RHSA-2026:44868 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

etcd: etcd: Authenticated user can bypass RBAC for unauthorized data access etcd: etcd: Authentication bypass due to improper Certificate Revocation List enforcement on gRPC listener etcd: etcd: Denial of Service via unbounded TLS handshake goroutines

UBUNTU-CVE-2026-73500

Affected: Ubuntu:16.04:LTS: etcd, Ubuntu:Pro:18.04:LTS: etcd, Ubuntu:Pro:20.04:LTS: etcd, Ubuntu:Pro:22.04:LTS: etcd, Ubuntu:Pro:24.04:LTS: etcd, Ubuntu:Pro:26.04:LTS: etcd

WID-SEC-W-2026-2825 — etcd: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in etcd ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um einen Denial of Service Angriff durchzuführen.