CVE-2026-73500
published 2026-08-12CVE-2026-73500: etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an…
PriorityP353high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.70%
52.5th percentile
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform | platform-operator-bundle | — | — |
| devspaces | traefik-rhel9 | — | — |
| etcd-io | etcd | < 3.5.33 | 3.5.33 |
| etcd-io | etcd | — | — |
| etcd-io | etcd | — | — |
| etcd | etcd | — | — |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift4 | oc-mirror-plugin-rhel9 | — | — |
| rhacm2 | observatorium-rhel9 | — | — |
| rhceph | rhceph-promtail-rhel9 | — | — |
| rhceph | snmp-notifier-rhel10 | — | — |
| rhceph | snmp-notifier-rhel8 | — | — |
| rhceph | snmp-notifier-rhel9 | — | — |
| rhoso-operators | openstack-operator-bundle | — | — |
| rhtas | certificate-transparency-rhel9 | — | — |
| rhtas | createtree-rhel9 | — | — |
| rhtas | trillian-database-rhel9 | — | — |
| rhtas | trillian-logserver-rhel9 | — | — |
| rhtas | trillian-logsigner-rhel9 | — | — |
| rhtas | updatetree-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
etcd-io etcd up to 3.5.32/3.6.13/3.7.0 TLS Listener listener_tls.go tls.Conn.Handshake infinite loop
vuldb·2026-08-12·CVSS 8.7
CVE-2026-73500 [HIGH] etcd-io etcd up to 3.5.32/3.6.13/3.7.0 TLS Listener listener_tls.go tls.Conn.Handshake infinite loop
A vulnerability was found in etcd-io etcd up to 3.5.32/3.6.13/3.7.0. It has been classified as problematic. This affects the function tls.Conn.Handshake of the file client/pkg/transport/listener_tls.go of the component TLS Listener. The manipulation leads to infinite loop.
This vulnerability is listed as CVE-2026-73500. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
Red Hat
etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
vendor_redhat·2026-08-12·CVSS 8.7
CVE-2026-73500 [HIGH] CWE-770 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
A flaw was found in etcd, a distributed key-value store. A r
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines [fedora-all]
bugzilla·2026-08-21·CVSS 8.7
CVE-2026-73500 [HIGH] CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines [fedora-all]
CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can
Bugzilla
CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
bugzilla·2026-08-12·CVSS 8.7
CVE-2026-73500 [HIGH] CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
CVE-2026-73500 etcd: etcd: Denial of Service via unbounded TLS handshake goroutines
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2https://github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057https://github.com/etcd-io/etcd/pull/22130https://github.com/etcd-io/etcd/releases/tag/v3.5.33https://github.com/etcd-io/etcd/releases/tag/v3.6.14https://github.com/etcd-io/etcd/releases/tag/v3.7.1https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
2026-08-12
Published