CVE-2026-73500 in etcd
Summary
by MITRE • 08/12/2026
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described represents a critical resource exhaustion flaw in etcd's TLS listener implementation that can lead to denial of service conditions affecting distributed systems relying on this key-value store. This issue exists in versions prior to 3.5.33, 3.6.14, and 3.7.1 where the tlsListener.acceptLoop function creates an unbounded number of goroutines to handle incoming TLS connections. When a network attacker establishes many TCP connections but never completes the TLS handshake by sending a ClientHello message, each connection spawns a blocking goroutine that remains in the pending map indefinitely. This design flaw creates a memory leak scenario where the etcd process continuously allocates memory for tracking these pending connections without proper cleanup mechanisms. The vulnerability directly maps to CWE-400, Resource Exhaustion, and specifically manifests as an uncontrolled resource consumption issue that affects system availability rather than confidentiality or integrity.
The operational impact of this vulnerability extends beyond simple memory exhaustion to potentially compromise entire distributed systems that depend on etcd for critical data storage and coordination. When the etcd process consumes all available memory due to the accumulation of pending connections, it becomes unavailable to serve legitimate requests, which can cascade into broader system failures. In Kubernetes environments where etcd serves as the backing store for the control plane, this vulnerability can effectively take down the entire cluster's management functionality. The attacker need only establish multiple TCP connections and maintain them in a half-open state without completing the TLS handshake, making the attack relatively simple to execute while having severe consequences. This attack pattern aligns with ATT&CK technique T1499.004, Network Denial of Service, as it exploits network protocols to consume system resources and cause service unavailability.
The fix implemented in versions 3.5.33, 3.6.14, and 3.7.1 addresses this vulnerability by introducing proper connection handling mechanisms that prevent unlimited goroutine creation and map growth. The solution likely involves implementing connection timeouts, connection limits, or more sophisticated resource management for pending TLS connections. This remediation ensures that even if an attacker attempts to establish many half-open connections, the system will not continue allocating resources indefinitely. Organizations using etcd should immediately upgrade to these patched versions to protect against this vulnerability, as the attack requires minimal network access and can cause significant operational disruption. The fix demonstrates proper defensive programming practices by implementing resource limits and preventing unbounded growth patterns in concurrent systems. Regular security audits of TLS implementations in distributed systems should consider similar patterns that could lead to resource exhaustion attacks, particularly in high-concurrency environments where connection handling is critical to system stability and availability.