etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Priority MEDIUM 44CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 12 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Partial etcd (etcd-io): 3.5.33, 3.6.14, 3.7.1go.etcd.io/etcd/v3 (Go): 3.7.1, 3.6.14, 3.5.33Red Hat: 19 advisoriesRed Hat: 15 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| etcd-io | etcd | before 3.5.33; 3.6.0 to before 3.6.14; 3.7.0-alpha.0 to before 3.7.1 | 3.5.33, 3.6.14, 3.7.1 | Patch available | CNA |
| — | go.etcd.io/etcd/v3 (Go) | 3.7.0-alpha.0 to before 3.7.1 | 3.7.1 | Patch available | GHSA-6vch-q96h-7gc3 |
| — | go.etcd.io/etcd/v3 (Go) | 3.6.0 to before 3.6.14 | 3.6.14 | Patch available | GHSA-6vch-q96h-7gc3 |
| — | go.etcd.io/etcd/v3 (Go) | before 3.5.33 | 3.5.33 | Patch available | GHSA-6vch-q96h-7gc3 |
- etcd Vendoretcd-io Affected before 3.5.33; 3.6.0 to before 3.6.14; 3.7.0-alpha.0 to before 3.7.1 Fixed in 3.5.33, 3.6.14, 3.7.1 Patch available CNA
- go.etcd.io/etcd/v3 (Go) Vendor— Affected 3.7.0-alpha.0 to before 3.7.1 Fixed in 3.7.1 Patch available GHSA-6vch-q96h-7gc3
- go.etcd.io/etcd/v3 (Go) Vendor— Affected 3.6.0 to before 3.6.14 Fixed in 3.6.14 Patch available GHSA-6vch-q96h-7gc3
- go.etcd.io/etcd/v3 (Go) Vendor— Affected before 3.5.33 Fixed in 3.5.33 Patch available GHSA-6vch-q96h-7gc3
Remediation
- Fix · CNA etcd (etcd-io) Fixed in 3.5.33, 3.6.14, 3.7.1
- Fix · GHSA-6vch-q96h-7gc3 go.etcd.io/etcd/v3 (Go) Fixed in 3.7.1 Advisory →
- Fix · GHSA-6vch-q96h-7gc3 go.etcd.io/etcd/v3 (Go) Fixed in 3.6.14 Advisory →
- Fix · GHSA-6vch-q96h-7gc3 go.etcd.io/etcd/v3 (Go) Fixed in 3.5.33 Advisory →
Red Hat 19 advisories
- RHSA-2026:90330 Released 2026-10-26 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 security advisory
- Red Hat OpenStack Platform 16.2 collectd-libpod-stats-1.0.4-6.2.el8ost, collectd-sensubility-0.2.1-1.3.el8ost, etcd-3.3.23-25.el8ost
- RHSA-2026:90329 Released 2026-10-26 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 security advisory
- Red Hat OpenStack Platform 17.1 collectd-libpod-stats-1.0.6-9.el9ost, collectd-sensubility-0.2.1-8.el9ost, etcd-3.4.26-9.10.el9ost
- RHSA-2026:90321 Released 2026-10-26 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.31.0 Release.
- Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
Show 16 more Red Hat advisories
- RHSA-2026:83598 Released 2026-10-15 · Red Hat rating ImportantRHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:83597 Released 2026-10-15 · Red Hat rating ImportantRHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:83596 Released 2026-10-15 · Red Hat rating ImportantRHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/createtree-rhel9
- RHSA-2026:73419 Released 2026-09-29 · Red Hat rating ImportantMulticluster Global Hub 1.6.6 security update
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:72854 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.11 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +8
- RHSA-2026:72853 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.10.7 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +7
- RHSA-2026:72851 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.8 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
- RHSA-2026:72850 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.15 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
- RHSA-2026:72849 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.3 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
- RHSA-2026:72848 Released 2026-09-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.7 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/azure-service-operator-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +7
- RHSA-2026:71597 Released 2026-09-24 · Red Hat rating ImportantMulticluster Global Hub 1.5.8 security update
- Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:70829 Released 2026-09-23 · Red Hat rating ImportantRHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
- RHSA-2026:70828 Released 2026-09-23 · Red Hat rating ImportantRHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
- RHSA-2026:70826 Released 2026-09-23 · Red Hat rating ImportantRHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/createtree-rhel9
- RHSA-2026:67516 Released 2026-09-15 · Red Hat rating ImportantMulticluster Global Hub 1.4.9 security update
- Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:44868 Released 2026-07-24 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images etcd-3.7.1-0.1.hum1@aarch64, etcd-3.7.1-0.1.hum1@src, etcd-3.7.1-0.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet |
| ExternalDNS Operator | Affected | No fix yet |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet |
| Multicluster Global Hub 1.4.9 | Fixed | RHSA-2026:67516 |
| Multicluster Global Hub 1.5.8 | Fixed | RHSA-2026:71597 |
| Multicluster Global Hub 1.6.6 | Fixed | RHSA-2026:73419 |
| Red Hat Hardened Images | Fixed | RHSA-2026:44868 |
| Red Hat OpenShift Dev Spaces 3.31 | Fixed | RHSA-2026:90321 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2026:90330 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2026:90329 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:70826, RHSA-2026:70828, RHSA-2026:70829 |
| Red Hat Trusted Artifact Signer 1.4 | Fixed | RHSA-2026:83596, RHSA-2026:83597, RHSA-2026:83598 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:72853 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:72848 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:72849 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:72850 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:72854 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:72851 |
Not affected: 20 products
- Multicluster Engine for Kubernetes
- Multicluster Global Hub 1.4.9
- Multicluster Global Hub 1.5.8
- Multicluster Global Hub 1.6.6
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.31
- Red Hat OpenShift GitOps
- Red Hat OpenStack Platform 18.0
- Red Hat Trusted Artifact Signer 1.3
- Red Hat Trusted Artifact Signer 1.4
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73500
- 2026-10-03 Alias added: GHSA-6vch-q96h-7gc3
- 2026-10-16 Fix available: RHSA-2026:83596 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83597 · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
- 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
- 2026-10-24 Affected versions changed · Red Hat
- 2026-10-26 Fix available: RHSA-2026:90329 · Red Hat
- 2026-10-26 Fix available: Red Hat OpenStack Platform 17.1 · Red Hat
- 2026-10-27 EPSS moved to the below the 50th percentile
- 2026-10-27 Fix available: Red Hat OpenStack Platform 16.2 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:90330 · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 10
- https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
- https://github.com/etcd-io/etcd/pull/22130
- https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
- https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372
- https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3
- https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
- https://github.com/etcd-io/etcd
More etcd-io vulnerabilities
- TI-2021-09444 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to… CVSS 3.1CRITICAL 9.8
- TI-2026-25810 etcd: Authorization bypasses in multiple APIs CVSS 4.0HIGH 8.8
- TI-2022-15016 Etcd v3.5.4 allows remote attackers to cause a denial of service via function… CVSS 3.1HIGH 7.5
- TI-2018-12096 Improper authentication in etcd: CVSS 3.1HIGH 8.1
- TI-2026-42635 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation CVSS 3.1HIGH 8.1
- TI-2020-11890 No minimum password length in etcd CVSS 3.1HIGH 7.5
Sources
- CVE-2026-73500 · CVE Program
- CVE-2026-73500 · NVD
- FIRST EPSS
- GHSA-6vch-q96h-7gc3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-73500 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences