CVE-2026-73500
CVE-2026-73500 — etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Published Updated Sources: cvelistV5, GitHub_M
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
8.7
HIGH
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
Exploitation
None
none · proof-of-concept · active
Automatable
Yes
can an attacker script all four kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 8.7 | CVSS 4.0 | HIGH | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-770
Attack patterns reported against this CVE. The ATT&CK techniques below are inferred from its weakness class.
- T1498.001Network Denial of Service: Direct Network Flood
- T1499Endpoint Denial of Service
- T1499.003Endpoint Denial of Service: Application Exhaustion Flood
Detection
Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.
- Search application, proxy, and WAF logs for requests touching /pkg/transport/listener_tls.go.
References
9 on the record
- github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
x_refsource_CONFIRM
- github.com/etcd-io/etcd/pull/22130
x_refsource_MISC
- github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
x_refsource_MISC
- github.com/etcd-io/etcd/commit/89ff6d50796049d4f1136915ba21504b76e7e372
x_refsource_MISC
- github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3
x_refsource_MISC
- github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
x_refsource_MISC
- github.com/etcd-io/etcd/releases/tag/v3.5.33
x_refsource_MISC
- github.com/etcd-io/etcd/releases/tag/v3.6.14
x_refsource_MISC
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.