CVE-2026-73500

Received Received - Intake

Memory Exhaustion in etcd TLS Listener

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73500

Affected Vendors & Products

Vendor	Product	Version / Range
etcd	etcd	to 3.5.33 (exc)
etcd	etcd	to 3.6.14 (exc)
etcd	etcd	to 3.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in etcd allows a network attacker to exhaust server memory by opening many TCP connections without completing a TLS handshake. Each connection spawns a goroutine that blocks indefinitely, causing unbounded resource consumption and potential cluster unavailability.

Detection Guidance

Detecting this vulnerability requires checking for excessive TCP connections to etcd listeners without completing TLS handshakes. Monitor for high numbers of established connections from unknown sources using netstat or ss commands. Check etcd logs for repeated failed TLS handshake attempts or connection timeouts.

Impact Analysis

If you use etcd versions before 3.5.33, 3.6.14, or 3.7.1, an attacker could crash your etcd cluster by consuming all available memory. This would disrupt services relying on etcd, including Kubernetes control planes, leading to downtime and loss of data access.

Mitigation Strategies

Upgrade etcd to versions 3.5.33, 3.6.14, or 3.7.1 immediately. Implement rate limiting on etcd listeners to prevent connection exhaustion. Restrict network access to etcd ports using firewalls. Monitor memory usage and connection counts to detect potential exploitation attempts.

Hi! I’m here to help you understand CVE-2026-73500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70