Vulnerability Report: GO-2026-6107
- CVE-2026-73500, GHSA-6vch-q96h-7gc3
- Affects: go.etcd.io/etcd/client/pkg/v3
- Published: Aug 18, 2026
In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.
For detailed information about this vulnerability, visit https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3.
Affected Packages
-
PathGo VersionsSymbols
-
before v3.5.33, from v3.6.0 before v3.6.14, from v3.7.0-alpha.0 before v3.7.1
Aliases
References
- https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
- https://github.com/etcd-io/etcd/pull/22130
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
- https://vuln.go.dev/ID/GO-2026-6107.json
Credits
- VMware By Broadcom
Feedback
See anything missing or incorrect?
Suggest an edit to this report.