CVE-2026-73500

Name of the Vulnerable Software and Affected Versions etcd versions prior to 3.5.33 etcd versions prior to 3.6.14 etcd versions prior to 3.7.1

Description A network attacker capable of reaching an etcd TLS listener can initiate numerous TCP connections without sending a ClientHello. Within the file client/pkg/transport/listener tls.go, the tlsListener.acceptLoop function spawns a goroutine for each connection that blocks indefinitely during the tls.Conn.Handshake() process and remains tracked in the pending map. This unbounded growth of goroutines and the map can exhaust the memory of the etcd process, leading to a loss of availability for the cluster and the Kubernetes control plane if etcd is used as its backing store.

Recommendations Update to version 3.5.33 or later. Update to version 3.6.14 or later. Update to version 3.7.1 or later.