Go/go.etcd.io/etcd/v3 CVE-2026-73500: high 8.7, EPSS 0.40%
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Action: Upgrade go.etcd.io/etcd/v3 to 3.5.33 or later.
go get go.etcd.io/etcd/v3@v3.7.1go get go.etcd.io/etcd/v3@v3.6.14go get go.etcd.io/etcd/v3@v3.5.33Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.7.0-alpha.0 | 3.7.1 | - |
| 3.6.0 | 3.6.14 | - |
| 0 | 3.5.33 | - |
Fixed versions
| 3.7.1 | 3.6.14 | 3.5.33 |
Sources
- osv: GHSA-6vch-q96h-7gc3
- nvd: CVE-2026-73500
- https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
- https://github.com/etcd-io/etcd/pull/22130
- https://github.com/etcd-io/etcd/commit/2e07efce9745004eb4773cffaada9b5cdf77cff2
- https://github.com/etcd-io/etcd/commit/f73cba7d920019f91a1ea1f6697833e42731f057
- https://github.com/etcd-io/etcd
- https://github.com/etcd-io/etcd/releases/tag/v3.5.33
- https://github.com/etcd-io/etcd/releases/tag/v3.6.14
- https://github.com/etcd-io/etcd/releases/tag/v3.7.1
CVE-2026-73500 · published · modified · JSON