Go/go.etcd.io/etcd/client/pkg/v3 CVE-2026-73500: unknown, EPSS 0.40%

Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3

Action: Upgrade go.etcd.io/etcd/client/pkg/v3 to 3.5.33 or later.

go get go.etcd.io/etcd/client/pkg/v3@v3.5.33

go get go.etcd.io/etcd/client/pkg/v3@v3.6.14

go get go.etcd.io/etcd/client/pkg/v3@v3.7.1

Affected

Fixed versions

Sources

• osv: GO-2026-6107
• https://github.com/etcd-io/etcd/security/advisories/GHSA-6vch-q96h-7gc3
• https://github.com/etcd-io/etcd/pull/22130
• https://github.com/etcd-io/etcd/releases/tag/v3.5.33
• https://github.com/etcd-io/etcd/releases/tag/v3.6.14
• https://github.com/etcd-io/etcd/releases/tag/v3.7.1

CVE-2026-73500 · published 2026-08-18T16:38:10Z · modified 2026-08-19T21:41:59.273853582Z · JSON