Skip to content
Fencer Vulns
medium 6.5

CVE-2020-15106 json

Improper Input Validation in etcd

published 2020-08-05 6 y ago modified 2026-09-10 1 mo ago also BIT-etcd-2020-15106 , BIT-etcd-2020-15112 , CVE-2020-15112 , EUVD-2023-0749 , GHSA-m332-53r6-2w93 , GHSA-p4g4-wgrh-qrg2 , GO-2020-0005

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

Patch / fix

  • go go.etcd.io/etcd/v3 3.3.23, 3.4.10
  • go go.etcd.io/etcd 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
  • bitnami etcd 3.3.23, 3.4.10
  • etcd etcd 3.3.23, 3.4.10
  • etcd Debian 14, Debian 13, Debian 12 3.3.25+dfsg-5

debian advisories DEBIAN-CVE-2020-15106

  • etcd Ubuntu 20.04 LTS 3.2.26+dfsg-6ubuntu0.1
  • etcd Ubuntu Pro 18.04 LTS 3.2.17+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2020-15106

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • etcd RHEL 7 EXTRAS_OTHER 3.2.32-1.el7_9
  • etcd openstack 16.1 3.3.23-1.el8ost

red hat advisories RHSA-2021:1407RHSA-2021:0916

  • etcd openSUSE Leap 15.6, openSUSE Leap 15.5 3.5.12-150000.7.6.1
  • kubernetes SLE Module for Containers 15 SP1 1.17.13-4.21.2

suse advisories SUSE-SU-2024:3656-1SUSE-SU-2020:3760-1

  • etcd Package Hub 15 SP6, openSUSE Leap 15.6 3.5.12-bp156.4.3.1
  • etcd openSUSE Tumbleweed 3.4.16-3.1

opensuse advisories openSUSE-SU-2025:0003-1openSUSE-SU-2024:10741-1

  • etcd CBL-Mariner 2.0 3.5.0-3

azure linux advisories AZL-6388

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-15106 updated cvss 6.5

etcd: Large slice causes panic in decodeRecord method

  • Red Hat OpenStack Platform 15 (Stein) etcd
    affected: no fix available “Fix deferred”
  • Red Hat Storage 3 etcd
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras etcd 3.2.32-1.el7_9
    fixed: vendor fix RHSA-2021:1407
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-etcd v4.8.0-202106152230.p0.git.aefa6bf.assembly.stream
    fixed: vendor fix RHSA-2021:2438
  • Red Hat OpenStack Platform 16.1 etcd 3.3.23-1.el8ost
    fixed: vendor fix RHSA-2021:0916
  • Red Hat Advanced Cluster Management for Kubernetes 2 etcd Red Hat OpenShift Container Platform 4.8 openshift4/ose-cli v4.8.0-202106291725.p0.git.1077b05.assembly.stream, openshift4/ose-pod v4.8.0-202107161820.p0.git.051ac4f.assembly.stream, openshift4/ose-tests v4.8.0-202107131424.p0.git.0d958c3.assembly.stream, openshift4/ose-console v4.8.0-202107010336.p0.git.188a490.assembly.stream, openshift4/ose-coredns v4.8.0-202106291913.p0.git.642b46e.assembly.stream, openshift4/ose-grafana v4.8.0-202106291913.p0.git.b987e4b.assembly.stream, +135 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.26% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:N/A:P
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.etcd.io/etcd/v3
<3.3.23
>=3.4.0, <3.4.10
3.3.23
3.4.10
go go.etcd.io/etcd
<0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
0.5.0-alpha.5.0.20200423152442-f4b650b51dc4
bitnami etcd
<3.3.23
>=3.4.0, <3.4.10
3.3.23
3.4.10

Affected products

  • etcd-io etcd

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-129 Improper Validation of Array Index

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.