Executive brief
bbolt is a widely used embedded key-value database for Go, utilized by projects like etcd and Kubernetes. A reported issue suggested that the database could crash (panic) when processing corrupted data files containing empty branch pages. However, this advisory has been withdrawn as the maintainers determined the behavior does not constitute a security vulnerability in a production context.
Technical details
This vulnerability was originally reported as an out-of-bounds read (CWE-125) in the Bucket.Stats() function of the bbolt library. The issue occurred because the code attempted to access a branch page element using an index of -1 when the page element count was zero, leading to a Go panic. While a fix was merged to add a count guard, the advisory was subsequently withdrawn and the CVE rejected. Maintainers and the Go security team determined it to be a false positive because branch pages in a healthy bbolt database should never have zero elements, and the crash only occurs during manual statistics gathering on corrupted databases.
Affected products
- etcd-io bbolt <= 1.4.3
Timeline
- 2026-03-30: patched: Fix merged in bbolt repository
- 2026-04-06: disclosed: Initial CVE and GHSA published
- 2026-04-08: other: CVE marked as Rejected/False Positive
- 2026-04-13: other: GitHub Advisory withdrawn