Memory Exhaustion Vulnerability in etcd Distributed Key-Value Store
CVE-2026-73500
8.7HIGH
What is CVE-2026-73500?
A vulnerability exists in the etcd distributed key-value store that can be exploited by a network attacker. If an attacker can access the etcd TLS listener, they can open multiple TCP connections without sending a ClientHello. This results in unbounded growth of goroutines and the pending map, potentially exhausting available memory. Such memory exhaustion can lead to significant availability issues for the etcd process, particularly impacting Kubernetes's control plane if etcd is used as its backing store. It is crucial for users to upgrade to the fixed versions (3.5.33, 3.6.14, or 3.7.1) to mitigate these risks.
Affected Version(s)
etcd < 3.5.33 < 3.5.33
etcd >= 3.6.0, < 3.6.14 < 3.6.0, 3.6.14
etcd >= 3.7.0-alpha.0, < 3.7.1 < 3.7.0-alpha.0, 3.7.1