CVE-2026-73500

About vulnerability

In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service.

Affected product:

Grafana , Loki , MinIO , TritonDataCenter/triton-go , apache/cassandra-gocql-driver/gocql , argocd , argoproj/gitops-engine , benmathews/bench , coredns/coredns , etcd-io/etcd , etcd-io/etcd/client , etcd-io/etcd/client/pkg , etcd-io/etcd/pkg , etcd-io/etcd/raft , etcd-io/etcd/server , go-kit/kit , google/certificate-transparency-go , google/go-attestation , google/go-cloud , google/go-tpm , google/go-tpm-tools , google/go-tspi , google/trillian , gopkg.in/telebot.v3 , grafana/alerting , grafana/dskit , grafana/e2e , grafana/grafana-app-sdk , grafana/grafana/apps/alerting/notifications , grafana/grafana/apps/investigation , grafana/grafana/apps/playlist , grafana/grafana/pkg/aggregator , grafana/grafana/pkg/apimachinery , grafana/grafana/pkg/apiserver , grafana/grafana/pkg/promlib , grafana/grafana/pkg/storage/unified/apistore , grafana/grafana/pkg/storage/unified/resource , grafana/tempo , grpc-ecosystem/go-grpc-middleware , hashicorp/consul , hashicorp/go-discover , hashicorp/raft-wal , heroku/x , influxdata/telegraf , jaegertracing/jaeger , knadh/koanf , kubernetes-sigs/controller-runtime , kubernetes/apiextensions-apiserver , kubernetes/apiserver , kubernetes/cloud-provider , kubernetes/controller-manager , kubernetes/dynamic-resource-allocation , kubernetes/kube-aggregator , kubernetes/kube-controller-manager , kubernetes/kubelet , kubernetes/kubernetes , kubernetes/pod-security-admission , kubernetes/sample-apiserver , m3dbx/prometheus_remote_client_golang , minio/colorjson , minio/pkg , open-telemetry/opentelemetry-collector , open-telemetry/opentelemetry-collector-contrib/exporter/jaegerexporter , open-telemetry/opentelemetry-collector-contrib/exporter/kafkaexporter , open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter , open-telemetry/opentelemetry-collector-contrib/internal/sharedcomponent , open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver , open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver , open-telemetry/opentelemetry-collector/component , open-telemetry/opentelemetry-collector/confmap , open-telemetry/opentelemetry-collector/exporter , open-telemetry/opentelemetry-collector/exporter/otlpexporter , open-telemetry/opentelemetry-collector/extension/zpagesextension , open-telemetry/opentelemetry-collector/receiver , open-telemetry/opentelemetry-collector/receiver/otlpreceiver , openfga/openfga , prometheus/alertmanager , prometheus/prometheus , sagikazarmark/crypt , spf13/cobra , spf13/viper , weaveworks/common

Affected packages:

go.etcd.io/etcd/client/pkg @ 3.5.14 (+186 more)