high 8.7

CVE-2026-73500 json

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

published 2026-07-24 3 mo ago modified 2026-10-24 16 d ago also BIT-etcd-2026-73500 , EUVD-2026-57642 , GHSA-6vch-q96h-7gc3 , GO-2026-6107

cvss: 8.7; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits: 0; none known

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

Patch / fix

fixed in 5 distros 4 links 8

go go.etcd.io/etcd/v3 3.5.33, 3.6.14, 3.7.1
bitnami etcd 3.5.33, 3.6.14, 3.7.1
go go.etcd.io/etcd/client/pkg/v3 3.5.33, 3.6.14, 3.7.1
etcd etcd 3.5.33, 3.6.14, 3.7.1
redhat etcd 3.5.33, 3.6.14, 3.7.1

red hat suse opensuse azure linux

etcd hummingbird 1 3.7.1-0.1.hum1

red hat advisories RHSA-2026:44868

govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1

suse advisories SUSE-SU-2026:23625-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1

opensuse advisories openSUSE-SU-2026:21761-1

cert-manager Azure Linux 3.0 1.12.15-12
cloud-provider-kubevirt Azure Linux 3.0 0.5.1-7
flannel Azure Linux 3.0 0.24.2-31
keda Azure Linux 3.0 2.14.1-18
kube-vip-cloud-provider Azure Linux 3.0 0.0.10-8
kubernetes Azure Linux 3.0 1.30.10-29
prometheus-adapter Azure Linux 3.0 0.12.0-9

azure linux advisories AZL-95901 AZL-95907 AZL-95913 AZL-95931 AZL-95934 AZL-95937

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/etcd-io/etcd@2e07efc commit
github.com/etcd-io/etcd@89ff6d5 commit
github.com/etcd-io/etcd@8e4dd06 commit
github.com/etcd-io/etcd@f73cba7 commit
github.com/etcd-io/etcd#22130 pull request
github.com/etcd-io/etcd/releases/tag/v3.5.33 release
github.com/etcd-io/etcd/releases/tag/v3.6.14 release
github.com/etcd-io/etcd/releases/tag/v3.7.1 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-73500 updated 2026-11-06 cvss 7.5

etcd: etcd: Denial of Service via unbounded TLS handshake goroutines

Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9 Red Hat ExternalDNS Operator edo/external-dns-rhel9
affected: workaround, no fix available
Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-9-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Serverless openshift-serverless-1/logic-rhel9-operator Red Hat Ceph Storage 5 rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 rhceph/snmp-notifier-rhel9, rhceph/rhceph-promtail-rhel9 Red Hat Ceph Storage 7 rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 8 rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 9 rhceph/snmp-notifier-rhel10

+1 more productsfewer

Red Hat OpenShift Container Platform 4 openshift4/ose-kube-rbac-proxy-rhel9

affected: workaround, no fix available
Red Hat OpenShift AI (RHOAI) rhoai/odh-kube-rbac-proxy-rhel9
under investigation
Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hypershift-addon-rhel9-operator 1790117675
fixed: vendor fix RHSA-2026:72850
Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hypershift-addon-rhel9-operator 1790121330
fixed: vendor fix RHSA-2026:72854
Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hypershift-addon-rhel9-operator 1790125038
fixed: vendor fix RHSA-2026:72851
Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hypershift-addon-rhel9-operator 1790129949
fixed: vendor fix RHSA-2026:72853

show 14 more

Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hypershift-addon-rhel9-operator 1790132736
fixed: vendor fix RHSA-2026:72848
Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/hive-rhel9 1790286311, multicluster-engine/hypershift-addon-rhel9-operator 1790134636
fixed: vendor fix RHSA-2026:72849
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1788375682
fixed: vendor fix RHSA-2026:67516
Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1789515639
fixed: vendor fix RHSA-2026:71597
Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1790086248
fixed: vendor fix RHSA-2026:73419
Red Hat Hardened Images etcd 3.7.1-0.1.hum1
fixed: vendor fix RHSA-2026:44868
Red Hat OpenShift Dev Spaces 3.31 devspaces/traefik-rhel9 1792464177
fixed: vendor fix RHSA-2026:90321
Red Hat OpenStack Platform 16.2 etcd 3.3.23-25.el8ost, collectd-sensubility 0.2.1-1.3.el8ost, collectd-libpod-stats 1.0.4-6.2.el8ost
fixed: vendor fix RHSA-2026:90330
Red Hat OpenStack Platform 17.1 etcd 3.4.26-9.10.el9ost, collectd-sensubility 0.2.1-8.el9ost, collectd-libpod-stats 1.0.6-9.el9ost
fixed: vendor fix RHSA-2026:90329
Red Hat Trusted Artifact Signer 1.3 rhtas/createtree-rhel9 1789645873, rhtas/updatetree-rhel9 1789645873, rhtas/trillian-database-rhel9 1789645873, rhtas/trillian-logserver-rhel9 1789645873, rhtas/trillian-logsigner-rhel9 1789645873, rhtas/certificate-transparency-rhel9 1789655058
fixed: vendor fix RHSA-2026:70829
Red Hat Trusted Artifact Signer 1.4 rhtas/createtree-rhel9 1791549956, rhtas/updatetree-rhel9 1791549956, rhtas/trillian-database-rhel9 1791549956, rhtas/trillian-logserver-rhel9 1791549956, rhtas/trillian-logsigner-rhel9 1791549956, rhtas/certificate-transparency-rhel9 1791535218
fixed: vendor fix RHSA-2026:83598
Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/registration-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/multicloud-manager-rhel9, multicluster-engine/registration-operator-rhel9 Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hive-rhel9 1790229009, multicluster-engine/work-rhel9 1790168557, multicluster-engine/discovery-rhel9 1790117653, multicluster-engine/placement-rhel9 1790168545, multicluster-engine/console-mce-rhel9 1790117683, multicluster-engine/must-gather-rhel9 1790117610, +20 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1790229184, multicluster-engine/work-rhel9 1790199734, multicluster-engine/discovery-rhel9 1790121287, multicluster-engine/placement-rhel9 1790232806, multicluster-engine/console-mce-rhel9 1790121310, multicluster-engine/must-gather-rhel9 1790121246, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hive-rhel9 1790250146, multicluster-engine/work-rhel9 1790211430, multicluster-engine/discovery-rhel9 1790126244, multicluster-engine/placement-rhel9 1790196196, multicluster-engine/console-mce-rhel9 1789583887, multicluster-engine/must-gather-rhel9 1790125064, +23 more Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hive-rhel9 1790230875, multicluster-engine/work-rhel9 1790196178, multicluster-engine/discovery-rhel9 1790134510, multicluster-engine/placement-rhel9 1790197062, multicluster-engine/console-mce-rhel9 1790135546, multicluster-engine/must-gather-rhel9 1790128849, +24 more Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hive-rhel9 1790286327, multicluster-engine/work-rhel9 1790212824, multicluster-engine/discovery-rhel9 1790130973, multicluster-engine/placement-rhel9 1790212248, multicluster-engine/console-mce-rhel9 1790133081, multicluster-engine/must-gather-rhel9 1790134614, +25 more

+4 more productsfewer

Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/work-rhel9 1790212154, multicluster-engine/maestro-rhel9 1790134239, multicluster-engine/discovery-rhel9 1790262873, multicluster-engine/placement-rhel9 1790212220, multicluster-engine/console-mce-rhel9 1790135323, multicluster-engine/must-gather-rhel9 1790137474, +27 more Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1788355439, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1788355599, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1788355417, multicluster-globalhub/multicluster-globalhub-operator-bundle 1788377695, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1788200958 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1789515408, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1789515288, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1789478830, multicluster-globalhub/multicluster-globalhub-operator-bundle 1789533983, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1789255903 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1790085494, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1790086176, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1790085268, multicluster-globalhub/multicluster-globalhub-operator-bundle 1790379995, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1790379115

not affected: vulnerable code not present
Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/observatorium-rhel9, rhacm2/submariner-addon-rhel9, rhacm2/acm-volsync-addon-controller-rhel9, rhacm2/multicluster-observability-rhel9-operator, rhacm2/acm-governance-policy-addon-controller-rhel9
not affected: vulnerable code not in execute path
Red Hat Ansible Automation Platform 2 ansible-automation-platform/platform-operator-bundle
not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 mo ago (2026-08-13)

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
go	go.etcd.io/etcd/v3	>=3.7.0-alpha.0, <3.7.1 >=3.6.0, <3.6.14 <3.5.33	3.7.1 3.6.14 3.5.33
bitnami	etcd	<3.5.33 >=3.6.0, <3.6.14 >=3.7.0, <3.7.1	3.5.33 3.6.14 3.7.1
go	go.etcd.io/etcd/client/pkg/v3	<3.5.33 >=3.6.0, <3.6.14 >=3.7.0-alpha.0, <3.7.1	3.5.33 3.6.14 3.7.1

Affected products

etcd-io etcd

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary