update: go.etcd.io/etcd/client/pkg/v3

[github-actions]

Name: go.etcd.io/etcd/client/pkg/v3
CVEs: CVE-2026-73500, GHSA-6vch-q96h-7gc3, GO-2026-6107, GHSA-6vch-q96h-7gc3, GO-2026-6107
CVSSs: n/a
Action Needed: TBD
Summary: TLS listeners lack handshake deadlines, allowing unauthenticated attackers to create indefinitely blocked goroutines and exhaust memory, causing denial of service.

refmap.gentoo: TBD

[github-actions]

Gentoo Bugzilla has new or changed upstream context for this advisory.

Recommended review items:

• Add CVEs: GHSA-6vch-q96h-7gc3, GO-2026-6107
• Review upstream references: GHSA-6vch-q96h-7gc3, GHSA-6vch-q96h-7gc3, Set a tlsHandshakeTimeout for tlsListener etcd-io/etcd#22130, https://github.com/etcd-io/etcd/releases/tag/v3.5.33, https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• Review Bugzilla description: In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking ma...

Source: https://pkg.go.dev/vuln/GO-2026-6107

This is a guarded automation recommendation; maintainers should review before editing the advisory body.