GO-2026-6107
Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3
At a glance
- Published
- Updated
- CVE
- CVE-2026-73500
- Aliases
- BIT-etcd-2026-73500, GHSA-6vch-q96h-7gc3
Description
In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.
Affected packages
| Package | Versions |
|---|---|
| Go · go.etcd.io/etcd/client/pkg/v3 | introduced 0, fixed 3.5.33, introduced 3.6.0, fixed 3.6.14, introduced 3.7.0-alpha.0, fixed 3.7.1 |
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3 ADVISORY
- https://github.com/etcd-io/etcd/pull/22130 FIX
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33 WEB
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14 WEB
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |