CVE-2026-73500: etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.
Other sources
etcd: tlsListener.acceptLoop spawns unbounded handshake goroutines with no deadline
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.12.0-9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.10-28 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.12.15-12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.0.10-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.14.1-17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.24.2-30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.5.1-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.33 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.6.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73500?
CVE-2026-73500 has a risk score of 70, indicating a moderate threat level.
How do I fix CVE-2026-73500?
To mitigate CVE-2026-73500, upgrade etcd to versions 3.5.33, 3.6.14, or 3.7.1 or later.
What type of attack does CVE-2026-73500 describe?
CVE-2026-73500 describes a denial of service vulnerability due to unbounded handshake goroutines that can be exploited by network attackers.
Which software is affected by CVE-2026-73500?
CVE-2026-73500 affects the etcd distributed key-value store.
What can happen if CVE-2026-73500 is exploited?
If exploited, CVE-2026-73500 can lead to resource exhaustion and impact the availability of the etcd service.