A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).
This...
id: GO-ID-PENDING
modules:
- module: go.etcd.io/etcd
vulnerable_at: 2.3.8+incompatible
- module: go.etcd.io/etcd/v3
versions:
- fixed: 3.5.33
- introduced: 3.6.0
- fixed: 3.6.14
- introduced: 3.7.0-alpha.0
- fixed: 3.7.1
vulnerable_at: 3.7.0
summary: |-
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no
deadline in go.etcd.io/etcd
ghsas:
- GHSA-6vch-q96h-7gc3
references:
- advisory: https://github.com/advisories/GHSA-6vch-q96h-7gc3
- advisory: https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
- fix: https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
- fix: https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
- fix: https://github.com/etcd-io/etcd/pull/22130
- web: https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- web: https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- web: https://github.com/etcd-io/etcd/releases/tag/v3.7.1
source:
id: GHSA-6vch-q96h-7gc3
created: 2026-07-24T23:02:18.715789471Z
review_status: UNREVIEWED
Advisory GHSA-6vch-q96h-7gc3 references a vulnerability in the following Go modules:
Description:
Impact
What kind of vulnerability is it? Who is impacted?
A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Handshake(), and each is tracked in the pending map. Unbounded goroutine and map growth exhausts memory in the etcd process, causing loss of availability for the etcd cluster (and, when etcd backs Kubernetes, the control plane).
Patches
Has the problem been patched? What versions should users upgrade to?
This...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.